diff --git a/README.md b/README.md index 146b3e1..e787209 100644 --- a/README.md +++ b/README.md @@ -75,3 +75,8 @@ vault write auth/kubernetes/role/vault-test \ 1. `vault kv put kv/secret/vault-test username='vassiliy' password='password' database='testdb' psqlhost='psql-service'` 2. `vault kv get -format=json kv/secret/vault-test | jq ".data.data"` 3. `k apply -f k8s/vault-test.yaml` + + +### 5. Add-ons + +1. [restore-root](docs/restore-root--token.md) diff --git a/docs/commands.md b/docs/commands.md new file mode 100644 index 0000000..2c7247d --- /dev/null +++ b/docs/commands.md @@ -0,0 +1,11 @@ +# частные команды + +## Tokens +1. `vault token lookup` +2. `vault list auth/token/accessors` +3. `vault token revoke -accessor ` + +# Polices + +1. `vault read sys/policy` +2. `vault secrets enable -version=2 -path=secret kv` diff --git a/docs/policy-example.md b/docs/policy-example.md new file mode 100644 index 0000000..4cba34c --- /dev/null +++ b/docs/policy-example.md @@ -0,0 +1,67 @@ +# Example policy + +[!] + +## открыть полный доступ на все под-пути +path "secret/*" { + capabilities = ["create", "read", "update", "patch", "delete", "list"] +} + +## если давать полные права, но запрещать удаление + +path "secrets/*" { + capabilities = ["create", "read", "update", "list"] +} +path "secrets/destroy/*" { + capabilities = ["deny"] +} +path "secrets/delete/*" { + capabilities = ["deny"] +} + +## закрыть доступ к конкретному секрету +path "secret/super-secret" { + capabilities = ["deny"] +} + +## открыть list на суб-путь +path "secret/+/team" { + capabilities = ["list"] +} + +# а вот так в KV работать не будет! +path "secret/restricted" { + capabilities = ["create"] + allowed_parameters = { + "foo" = [] + "bar" = ["zip", "zap"] + } +} + +## шаблоны + +path "secret/data/{{identity.entity.id}}/*" { + capabilities = ["create", "update", "patch", "read", "delete"] +} + +path "secret/metadata/{{identity.entity.id}}/*" { + capabilities = ["list"] +} + +[подробнее](https://www.vaultproject.io/docs/concepts/policies#examples) + +## задать обязательные переменные (в KV работать не будет!) + +path "secret/profile" { + capabilities = ["create"] + required_parameters = ["name", "id"] +} + +## или запретить какие-то из них (в KV работать не будет!) + +path "auth/userpass/users/*" { + capabilities = ["update"] + denied_parameters = { + "token_policies" = [] + } +} diff --git a/docs/policy-example.svg b/docs/policy-example.svg new file mode 100644 index 0000000..0cdd611 --- /dev/null +++ b/docs/policy-example.svg @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/restore-root-token.md b/docs/restore-root-token.md new file mode 100644 index 0000000..74621d7 --- /dev/null +++ b/docs/restore-root-token.md @@ -0,0 +1,6 @@ +# восстанавливаем токен рута + +1. `vault operator generate-root -generate-otp` +2. `vault operator generate-root -init -otp=""` +3. `vault operator generate-root` X столько раз, сколько ключей для распечатывания +4. `vault operator generate-root -decode="b64-token-root" -otp=""`