密钥与凭证管理

# 启用 KV v2（版本化）
vault secrets enable -path=secret -version=2 kv

# 写入密钥
vault kv put secret/app/database \
  username=dbuser \
  password=supersecret

# 读取密钥
vault kv get -format=json secret/app/database

# 版本管理
vault kv put secret/app/database password=newpass  # 创建 v2
vault kv get -version=1 secret/app/database        # 读取 v1
vault kv delete secret/app/database                # 软删除
vault kv undelete -versions=2 secret/app/database  # 恢复
vault kv destroy -versions=2 secret/app/database   # 永久删除

# 启用数据库引擎
vault secrets enable database

# 配置 PostgreSQL 连接
vault write database/config/my-postgresql \
  plugin_name=postgresql-database-plugin \
  allowed_roles="app" \
  connection_url="postgresql://{{username}}:{{password}}@db:5432/mydb" \
  username="vaultadmin" \
  password="vaultpass"

# 创建角色（定义生成的凭证权限）
vault write database/roles/app \
  db_name=my-postgresql \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
    GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl=1h \
  max_ttl=24h

# 获取动态凭证
vault read database/creds/app
# 返回：username=v-token-app-xxx, password=xxx, lease_duration=3600

# 应用使用 1 小时后，凭证自动过期，Vault 自动清理数据库用户

# Vault + K8s 认证 + External Secrets Operator
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-auth
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vault-auth-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: vault-auth
  namespace: default
---
# External Secret 从 Vault 同步到 K8s Secret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: vault-db-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: vault-backend
  target:
    name: db-credentials
  data:
    - secretKey: password
      remoteRef:
        key: secret/data/app/database
        property: password

import boto3

# KMS 加密/解密
kms = boto3.client('kms')

# 加密
encrypted = kms.encrypt(
    KeyId='alias/my-key',
    Plaintext=b'my-secret'
)

# Secrets Manager
secrets = boto3.client('secretsmanager')

# 创建密钥
secrets.create_secret(
    Name='prod/myapp/database',
    SecretString='{"username":"admin","password":"xxx"}'
)

# 获取密钥（自动解密）
response = secrets.get_secret(SecretId='prod/myapp/database')
credentials = json.loads(response['SecretString'])

# 自动轮换
secrets.rotate_secret(
    SecretId='prod/myapp/database',
    RotationLambdaARN='arn:aws:lambda:...:rotation-function'
)

// 阿里云 KMS SDK
Config config = new Config()
    .setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
    .setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))
    .setEndpoint("kms.cn-hangzhou.aliyuncs.com");

Client client = new Client(config);

// 解密数据密钥
DecryptRequest decryptReq = new DecryptRequest()
    .setCiphertextBlob(cipherKey);
DecryptResponse decryptRsp = client.decrypt(decryptReq);
byte[] plainKey = Base64.decode(decryptRsp.getBody().getPlaintext());

# 启用 PKI
vault secrets enable pki
vault secrets tune -max-lease-ttl=8760h pki

# 生成根证书
vault write -field=certificate pki/root/generate/internal \
  common_name="example.com" \
  ttl=8760h > ca.crt

# 创建角色（签发服务器证书）
vault write pki/roles/web-server \
  allowed_domains=example.com \
  allow_subdomains=true \
  max_ttl=72h

# 客户端获取短期证书
vault write -format=json pki/issue/web-server \
  common_name=app.example.com \
  ttl=24h
# 返回：certificate, issuing_ca, private_key, ca_chain

# vault.hcl
seal "pkcs11" {
  lib = "/usr/lib/softhsm/libsofthsm2.so"
  slot = "0"
  pin = "1234"
  key_label = "vault-unseal-key"
  hmac_key_label = "vault-hmac-key"
  generate_key = "true"
}

# 启用自动轮换
vault write database/rotate-role/app \
  db_name=my-postgresql

# 手动触发轮换
vault write -f database/rotate-root/my-postgresql

# K8s External Secrets 自动同步
# 配置 refreshInterval，定期从 Vault 拉取最新密钥