Vault initialized with 5 key shares and a key threshold of 3. Please securely distribute the key shares printed above. When the Vault is re-sealed, restarted, or stopped, you must supply at least 3 of these keys to unseal it before it can start servicing requests.
Vault does not store the generated master key. Without at least 3 key to reconstruct the master key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of existing unseal keys shares. See "vault operator rekey"for more information. # 以上的初始化产生的 key 和 token 非常重要，一定要妥善安全保管
-key-shares=<int> Number of key shares to split the generated master key into. This is the number of "unseal keys" to generate. This is aliased as "-n". The default is 5.
-key-threshold=<int> Number of key shares required to reconstruct the master key. This must be less than or equal to -key-shares. This is aliased as "-t". The default is 3.
unseal
这个时候只是初始化启动了 vault， 还需要我们用 key unseal to reconstruct the master key
root@ubuntu18-108:/etc/vault.d# vault operator unseal Unseal Key (will be hidden): Key Value --- ----- Seal Type shamir Initialized true Sealed true Total Shares 5 Threshold 3 Unseal Progress 1/3 Unseal Nonce 8950ac41-69ae-2a96-00db-610739dcbeee Version 1.7.1 Storage Type raft HA Enabled true
root@ubuntu18-108:/etc/vault.d# vault operator unseal Unseal Key (will be hidden): Key Value --- ----- Seal Type shamir Initialized true Sealed true Total Shares 5 Threshold 3 Unseal Progress 2/3 Unseal Nonce 8950ac41-69ae-2a96-00db-610739dcbeee Version 1.7.1 Storage Type raft HA Enabled true
root@ubuntu18-108:/etc/vault.d# vault operator unseal Unseal Key (will be hidden): Key Value --- ----- Seal Type shamir Initialized true Sealed false Total Shares 5 Threshold 3 Version 1.7.1 Storage Type raft Cluster Name vault-cluster-0618ae06 Cluster ID feca826b-0ffd-838f-412d-0c6687feee60 HA Enabled true HA Cluster n/a HA Mode standby Active Node Address <none> Raft Committed Index 24 Raft Applied Index 24
# login root@ubuntu18-108:/etc/vault.d# vault login token-for-login Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run "vault login" again. Future Vault requests will automatically use this token.
root@ubuntu18-108:/home/feiyang# systemctl status nginx ● nginx.service - A high performance web server and a reverse proxy server Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Sat 2021-06-12 09:45:56 +08; 1min 12s ago Docs: man:nginx(8) Process: 1365 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
Jun 12 09:45:55 ubuntu18-108 systemd[1]: Starting A high performance web server and a reverse proxy server... Jun 12 09:45:56 ubuntu18-108 nginx[1365]: nginx: [emerg] bind() to 192.168.1.108:8200 failed (99: Cannot assign requested address) Jun 12 09:45:56 ubuntu18-108 nginx[1365]: nginx: configuration file /etc/nginx/nginx.conf test failed Jun 12 09:45:56 ubuntu18-108 systemd[1]: nginx.service: Control process exited, code=exited status=1 Jun 12 09:45:56 ubuntu18-108 systemd[1]: nginx.service: Failed with result 'exit-code'. Jun 12 09:45:56 ubuntu18-108 systemd[1]: Failed to start A high performance web server and a reverse proxy server.
# journalctl check log root@ubuntu18-108:/home/feiyang# journalctl -u nginx -- Reboot -- Jun 12 08:42:37 ubuntu18-108 systemd[1]: Starting A high performance web server and a reverse proxy server... Jun 12 08:42:37 ubuntu18-108 nginx[1348]: nginx: [emerg] bind() to 192.168.1.108:8200 failed (99: Cannot assign requested address) Jun 12 08:42:37 ubuntu18-108 nginx[1348]: nginx: configuration file /etc/nginx/nginx.conf test failed Jun 12 08:42:37 ubuntu18-108 systemd[1]: nginx.service: Control process exited, code=exited status=1 Jun 12 08:42:37 ubuntu18-108 systemd[1]: nginx.service: Failed with result 'exit-code'. Jun 12 08:42:37 ubuntu18-108 systemd[1]: Failed to start A high performance web server and a reverse proxy server.
root@ubuntu18-108:~# cat /lib/systemd/system/nginx.service # Stop dance for nginx # ======================= # # ExecStop sends SIGSTOP (graceful stop) to the nginx process. # If, after 5s (--retry QUIT/5) nginx is still running, systemd takes control # and sends SIGTERM (fast shutdown) to the main process. # After another 5s (TimeoutStopSec=5), and if nginx is alive, systemd sends # SIGKILL to all the remaining processes in the process group (KillMode=mixed). # # nginx signals reference doc: # http://nginx.org/en/docs/control.html # [Unit] Description=A high performance web server and a reverse proxy server Documentation=man:nginx(8) After=network.target # 启动依赖，问题就在这里
认证方式有很多种。 https://www.vaultproject.io/docs/auth Each auth method serves a different purpose, and some auth methods are better suited for machine authentication rather than used by human users.
machine auth methods include AppRole,
Cloud-based auth methods, tokens, TLS, Kubernetes, and Radius.
human auth methods include Okta, LDAP, GitHub, OIDC, and userpass.
# HTTP API enable approle curl \ --header "X-Vault-Token: $VAULT_TOKEN" \ --request POST \ --data '{"type": "approle"}' \ http://127.0.0.1:8200/v1/sys/auth/approle
# create my-policy curl \ --header "X-Vault-Token: $VAULT_TOKEN" \ --request PUT \ --data '{"policy":"# Dev servers have version 2 of KV secrets engine mounted by default, so will\n# need these paths to grant permissions:\npath \"secret/data/*\" {\n capabilities = [\"create\", \"update\"]\n}\n\npath \"secret/data/foo\" {\n capabilities = [\"read\"]\n}\n"}' \ http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
# enable KV v2 secrets engine at secret/ using API curl \ --header "X-Vault-Token: $VAULT_TOKEN" \ --request POST \ --data '{ "type":"kv-v2" }' \ http://127.0.0.1:8200/v1/sys/mounts/secret
# get secret-id curl \ --header "X-Vault-Token: $VAULT_TOKEN" \ --request POST \ http://127.0.0.1:8200/v1/auth/approle/role/my-role/secret-id | jq -r ".data"
# auth with the role-id and secret-id curl --request POST \ --data '{"role_id": "3c301960-8a02-d776-f025-c3443d513a18", "secret_id": "22d1e0d6-a70b-f91f-f918-a0ee8902666b"}' \ http://127.0.0.1:8200/v1/auth/approle/login | jq -r ".auth"
# set new token from my-role auth export VAULT_TOKEN="s.p5NB4dTlsPiUU94RA5IfbzXv"
# Create a version 1 of secret named creds with a key password and its value set to my-long-password. curl \ --header "X-Vault-Token: $VAULT_TOKEN" \ --request POST \ --data '{ "data": {"password": "my-long-password"} }' \ http://127.0.0.1:8200/v1/secret/data/creds | jq -r ".data"
# You can stop the server and unset the VAULT_TOKEN environment variable. unset VAULT_TOKEN