HashiCorp Vault를 설치하고 설정하는 방법

HashiCorp Vault를 설치하고 설정하는 방법

HashiCorp Vault를 설치하고 초기화, 인증, 비밀 저장 및 삭제 그리고 Vault의 시크릿 엔진 관리 기능을 사용한 예시입니다.

테스트 환경

Vault 버전 확인

$ vault version 
Vault v1.12.2 (415e1fe3118eebd5df6cb60d13defdc01aa17b03), built 2022-11-23T12:53:46Z

1. Vault 상태 확인 및 초기화

Vault 상태 확인 (TLS 검증 무시)

vault status -tls-skip-verify

$ vault status -tls-skip-verify
Key                Value
---                -----
Seal Type          shamir
Initialized        true
Sealed             true
Total Shares       5
Threshold          3
Unseal Progress    0/3
Unseal Nonce       n/a
Version            1.12.2
Build Date         2022-11-23T12:53:46Z
Storage Type       file
HA Enabled         false

vault status -output-curl-string

$ vault status -output-curl-string
curl -H "X-Vault-Request: true" http://127.0.0.1:8200/v1/sys/seal-status

cURL을 사용하여 Vault 상태 확인

curl -sSfL -H "X-Vault-Request: true" http://127.0.0.1:8200/v1/sys/seal-status | jq

$ curl -sSfL -H "X-Vault-Request: true" http://127.0.0.1:8200/v1/sys/seal-status | jq
{
  "type": "shamir",
  "initialized": true,
  "sealed": false,
  "t": 3,
  "n": 5,
  "progress": 0,
  "nonce": "",
  "version": "1.12.2",
  "build_date": "2022-11-23T12:53:46Z",
  "migration": false,
  "cluster_name": "vault-cluster-81637fc9",
  "cluster_id": "a0c6fdd0-cbf9-3214-dcbc-6f50584e2750",
  "recovery_seal": false,
  "storage_type": "file"
}

2. Vault 로그인

vault login hvs.7axXYWtfZ4qBwrvwDmoPONrc

3. 시크릿 엔진 관리

활성화된 시크릿 엔진 목록 확인

vault secrets list

$ vault secrets list                         
Path          Type         Accessor              Description
----          ----         --------              -----------
cubbyhole/    cubbyhole    cubbyhole_b3b398e6    per-token private secret storage
identity/     identity     identity_224e21fb     identity store
sys/          system       system_f94fdca9       system endpoints used for control, policy and debugging

kv 시크릿 엔진 활성화

vault secrets enable kv

$ vault secrets enable kv
Success! Enabled the kv secrets engine at: kv/

활성화된 시크릿 엔진 목록 확인

vault secrets list

$ vault secrets list     
Path          Type         Accessor              Description
----          ----         --------              -----------
cubbyhole/    cubbyhole    cubbyhole_6ce97c6a    per-token private secret storage
identity/     identity     identity_ee6d38ea     identity store
kv/           kv           kv_10ef1cc7           n/a
sys/          system       system_aaae3d69       system endpoints used for control, policy and debugging

728x90

4. 시크릿 저장 및 조회

kv/hello 경로에 데이터 저장

vault kv put kv/hello target=world

$ vault kv put kv/hello target=world
Success! Data written to: kv/hello

kv/hello 경로의 데이터 조회

vault kv get kv/hello

$ vault kv get kv/hello
===== Data =====
Key       Value
---       -----
target    world

kv/my-secret 경로에 민감한 데이터 저장

vault kv put kv/my-secret value="s3c(eT"

$ vault kv put kv/my-secret value="s3c(eT"
Success! Data written to: kv/my-secret

kv/my-secret 경로의 데이터 조회

vault kv get kv/my-secret

$ vault kv get kv/my-secret
==== Data ====
Key      Value
---      -----
value    s3c(eT

5. 시크릿 삭제 및 시크릿 엔진 비활성화

kv/my-secret 경로의 데이터 삭제

vault kv delete kv/my-secret

$ vault kv delete kv/my-secret
Success! Data deleted (if it existed) at: kv/my-secret

kv 시크릿 엔진 비활성화

vault secrets disable kv/

$ vault secrets disable kv/
Success! Disabled the secrets engine (if it existed) at: kv/

6. Vault 상태 확인

시크릿 엔진 비활성화 후 상태 확인

vault status

$ vault status
Key                Value
---                -----
Seal Type          shamir
Initialized        true
Sealed             true
Total Shares       5
Threshold          3
Unseal Progress    0/3
Unseal Nonce       n/a
Version            1.12.2
Build Date         2022-11-23T12:53:46Z
Storage Type       file
HA Enabled         false

 

참고URL

- Secrets Engines : https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-secrets-engines

- Getting Started : https://developer.hashicorp.com/vault/tutorials/getting-started