HashiCorp Vault 密钥管理实战

# HashiCorp Vault 密钥管理实战 ## 为什么需要 Vault 硬编码密码、配置文件中的明文密钥、共享的 .env 文件都是安全隐患。Vault 提供了集中化的密钥管理解决方案。 ## KV Secret Engine ```bash # 启用 KV v2 引擎 vault secrets enable -path=secret kv-v2 # 写入密钥 vault kv put secret/myapp/config \ db_host=10.0.1.10 \ db_password=SuperS3cret \ api_key=ak-xxxxxxxxxxxxx # 读取 vault kv get secret/myapp/config # 版本管理 vault kv get -version=2 secret/myapp/config vault kv rollback -version=1 secret/myapp/config ``` ## 动态数据库凭据 ```bash # 配置 MySQL 引擎 vault secrets enable database vault write database/config/mydb \ plugin_name=mysql-database-plugin \ connection_url="{{username}}:{{password}}@tcp(10.0.1.10:3306)/" \ allowed_roles="app-readonly" \ username="vault_admin" \ password="admin_password" # 创建角色 vault write database/roles/app-readonly \ db_name=mydb \ creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; \ GRANT SELECT ON mydb.* TO '{{name}}'@'%';" \ default_ttl="1h" \ max_ttl="24h" # 获取临时凭据 vault read database/creds/app-readonly # username: v-approle-app-read-xxxxx # password: A1B2C3-random-pass # ttl: 1h (自动过期销毁) ``` ## Transit 加密引擎 ```bash vault secrets enable transit vault write -f transit/keys/my-encryption-key # 加密 vault write transit/encrypt/my-encryption-key \ plaintext=$(echo "sensitive data" | base64) # 解密 vault write transit/decrypt/my-encryption-key \ ciphertext="vault:v1:AbCdEf..." ``` ## Spring Boot 集成 ```yaml # bootstrap.yml spring: cloud: vault: uri: https://vault.example.com authentication: APPROLE app-role: role-id: ${VAULT_ROLE_ID} secret-id: ${VAULT_SECRET_ID} kv: backend: secret application-name: myapp ``` Vault 的动态凭据功能彻底消除了长期存在的静态密码风险，每次申请都是临时凭据，自动过期回收。