Vault 소개

$ vault kv put secret/hello foo=world
Key              Value
---              -----
created_time     2019-08-19T03:53:56.491587848Z
deletion_time    n/a
destroyed        false
version          1

# unzip vault_1.2.2_linux_amd64.zip
# sudo cp vault /usr/local/bin
# vault version
Vault v1.2.2

# vault server -dev
==> Vault server configuration:

             Api Address: http://127.0.0.1:8200
                     Cgo: disabled
         Cluster Address: https://127.0.0.1:8201
              Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
               Log Level: info
                   Mlock: supported: true, enabled: false
                 Storage: inmem
                 Version: Vault v1.2.2

WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory
and starts unsealed with a single unseal key. The root token is already
authenticated to the CLI, so you can immediately begin using Vault.

You may need to set the following environment variable:

    $ export VAULT_ADDR='http://127.0.0.1:8200'

The unseal key and root token are displayed below in case you want to
seal/unseal the Vault or re-authenticate.

Unseal Key: lgdr00WR/supFOZYzn6Pnkup4lLgCF1dsKJ+G4x/Tmg=
Root Token: s.sKZpL9GncNY8BtaJsgGBwpfr

Development mode should NOT be used in production installations!

==> Vault server started! Log data will stream in below:

# export VAULT_ADDR='http://127.0.0.1:8200'

# vault status
Key             Value
---             -----
Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.2.2
Cluster Name    vault-cluster-eb3cf07e
Cluster ID      fa8f56e4-d020-d001-e841-0cfb18e4d091
HA Enabled      false

# vault kv put secret/hello foo=world                                     
Key              Value
---              -----
created_time     2019-08-19T07:52:57.687010855Z
deletion_time    n/a
destroyed        false
version          1

# vault kv get secret/hello
====== Metadata ======
Key              Value
---              -----
created_time     2019-08-19T07:52:57.687010855Z
deletion_time    n/a
destroyed        false
version          1

=== Data ===
Key    Value
---    -----
foo    world

# vault operator seal
Success! Vault is sealed.

# vault kv get secret/hello
Error making API request.

URL: GET http://127.0.0.1:8200/v1/sys/internal/ui/mounts/secret/hello
Code: 503. Errors:

* error performing token check: Vault is sealed

# vault operator unseal lgdr00WR/supFOZYzn6Pnkup4lLgCF1dsKJ+G4x/Tmg=
Key             Value
---             -----
Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.2.2
Cluster Name    vault-cluster-eb3cf07e
Cluster ID      fa8f56e4-d020-d001-e841-0cfb18e4d091
HA Enabled      false

# vault operator seal  
Success! Vault is sealed.
vault operator unseal
Unseal Key (will be hidden): <여기에 unseal key 들을 입력해야 한다.) 

# vault kv put secret/creds passcode=my-long-passcode
Key              Value
---              -----
created_time     2019-08-19T08:41:05.371486114Z
deletion_time    n/a
destroyed        false
version          1

vault kv get secret/creds
====== Metadata ======
Key              Value
---              -----
created_time     2019-08-19T08:41:05.371486114Z
deletion_time    n/a
destroyed        false
version          1

====== Data ======
Key         Value
---         -----
passcode    my-long-passcode

package main

import (
    "fmt"
    "github.com/hashicorp/vault/api"
    "os"
)

var token = os.Getenv("TOKEN")
var vault_addr = os.Getenv("VAULT_ADDR")

func main() {
    config := &api.Config{
        Address: vault_addr,
    }
    client, err := api.NewClient(config)
    if err != nil {
        fmt.Println(err)
        return
    }
    client.SetToken(token)
    secret, err := client.Logical().Read("secret/data/creds")
    if err != nil {
        fmt.Println(err)
        return
    }
    m, ok := secret.Data["data"].(map[string]interface{})
    if !ok {
        fmt.Println("%T", secret.Data["data"])
        return
    }
    fmt.Printf(m["passcode"].(string))
}

# vault policy list
default
root

$ vault policy read default
# Allow tokens to look up their own properties
path "auth/token/lookup-self" {
    capabilities = ["read"]
}

# Allow tokens to renew themselves
path "auth/token/renew-self" {
    capabilities = ["update"]
}

# Allow tokens to revoke themselves
path "auth/token/revoke-self" {
    capabilities = ["update"]
}
...... 생략