Vault - dev 환경 구축

Windows 환경에서 구축했습니다.
vault의 Approle 기능을 활용하여 어플리케이션 별 로그인 기능 분리가 추가되었습니다.

1. vault dev 서버 실행

# Windows Power shell
> .\vault.exe server -dev

2. secret engine 설정

• secret engine list 확인

  > .\vault.exe secrets list
  Path          Type         Accessor              Description
  ----          ----         --------              -----------
  cubbyhole/    cubbyhole    cubbyhole_318421a2    per-token private secret storage
  identity/     identity     identity_3392a061     identity store

• app 이름 별 secret engine 생성
  ex) airflow, aws, database ...

  > .\vault secrets enable -path=cda kv 
  Success! Enabled the kv secrets engine at: cda/

3. secret 생성

• secret 생성

  ### Airflow secret 생성 
  > .\vault kv put cda/airflow/dev/airflow id="airflowid" pw="airflowpw"
  Success! Data written to: cda/airflow/dev/airflow
  
  ### snowflake secret 생성
  > .\vault kv put cda/airflow/dev/snowflake id="snowflakeid" pw="snowflakepw" account="snowflakeacc"
  Success! Data written to: cda/airflow/dev/snowflake
  

• 생성된 secret 확인

  ### Airflow secret 확인
  > .\vault kv list cda
  Keys
  ----
  airflow/
  
  > .\vault.exe kv get cda/airflow/dev/airflow
  === Data ===
  Key    Value
  ---    -----
  id     airflowid
  pw     airflowpw

4. policy(정책) 설정

• policy 생성(어플리케이션 별 따로 생성)

  ### airflow
  path "cda/*" {
    capabilities = ["create", "update"]
  }
  path "cda/airflow/dev/*" { 
    capabilities = ["read"]
  }
  -----------------------------------
  ### snowflake
  path "cda/*" {
    capabilities = ["create", "update"]
  }
  path "cda/airflow/dev/*" {
    capabilities = ["read"]
  }

• policy를 vault에 등록

  # policy 등록
  > .\vault.exe policy write snowflake-policy .\snowflake-policy.cfg
  > .\vault.exe policy write airflow-policy .\airflow-policy.cfg
  
  # policy 확인
  > .\vault policy list

• Approle생성

  ### auth 정보 확인
  > .\vault auth list
  Path      Type     Accessor               Description                Version
  ----      ----     --------               -----------                -------
  token/    token    auth_token_0350fdf2    token based credentials    n/a
  
  ### approle 생성
  > .\vault auth enable approle
  Success! Enabled approle auth method at: approle/
  
  ### auth 정보 확인 
  > .\vault auth list
  Path        Type       Accessor                 Description                Version
  ----        ----       --------                 -----------                -------
  approle/    approle    auth_approle_68ff3fb0    n/a                        n/a
  token/      token      auth_token_0350fdf2      token based credentials    n/a

• 특정 사용자에게 정책 할당

  ### airflow-role에 정책 할당
  > .\vault write auth/approle/role/airflow-role `
  secret_id_ttl=10m `
  token_num_uses=10 `
  token_ttl=20m `
  token_max_ttl=30m `
  secret_id_num_uses=40 `
  secret_id_bound_cidrs="0.0.0.0/0" `
  token_policies=airflow-policy
  Success! Data written to: auth/approle/role/airflow-role

  ### snowflake-role에 정책 할당
  > .\vault write auth/approle/role/snowflake-role ` 
  secret_id_ttl=10m `
  token_num_uses=10 `
  token_ttl=20m `
  token_max_ttl=30m `
  secret_id_num_uses=40 `
  secret_id_bound_cidrs="0.0.0.0/0" `
  token_policies=snowflake-policy
  Success! Data written to: auth/approle/role/snowflake-role

• 설정된 approle 확인

  # approle list 확인
  > .\vault.exe list auth/approle/role
  Keys
  ----
  airflow-role
  snowflake-role
  
  # policy값들 확인
  > .\vault read sys/policy/airflow-policy
  Key      Value
  ---      -----
  name     airflow-policy
  rules    path "cda/*" {
    capabilities = ["read", "create", "update"]
  }
  path "cda/airflow/dev/airflow" {
    capabilities = ["read"]
  }

5. Get role_id, secret_id

### Get airflow role_id, secret_id
# airflow role_id
> .\vault read -field=role_id auth/approle/role/airflow-role/role-id
cc07e736-ff42-29a0-11aa-0e8268616cca

# airflow secret_id
> .\vault write -f auth/approle/role/airflow-role/secret-id
Key                   Value
---                   ----- 
secret_id             1f3c1f6f-41f1-b4f2-5e73-73f0b11e7401

### Get snowflake role_id, secret_id
# snowflake role_id
> .\vault read -field=role_id auth/approle/role/snowflake-role/role-id
9b65855e-ca5b-0736-0a63-e8505c908b88

# snowflake secret_id
> .\vault write -f -field=secret_id auth/approle/role/snowflake-role/secret-id
3bea1d4c-e739-a82a-aa2a-c686d82eea63

6. policy를 이용한 token 생성

### airflow-policy token 생성
> .\vault.exe token create -policy=airflow-policy
Key                  Value
---                  -----
token                hvs.CAESIF5Qstcrz49PcH0Fk-RuE-5-8ij9oXZ7DX758Wl39mGoGh4KHGh2cy51UkhialdLRTZ4Q0tsTHdYc09qZ2dHSUw


### snowflake-policy token 생성
> .\vault.exe token create -policy=snowflake-policy
Key                  Value
---                  -----
token                hvs.CAESIPJl3QzM9TMB7LWShaX8L8fQkv_ihxSDo4APVjPpGSSPGh4KHGh2cy5mZ044ekxxT09DUjhVYmQyeEZteGk2RFY

ETC

• 정책 새로고침

  > .\vault policy write airflow-policy .\airflow-policy.cfg
  Success! Uploaded policy: airflow-policy

에러 해결

# Error
Error listing secrets engines: Get "https://127.0.0.1:8200/v1/sys/mounts": http: server gave HTTP response to HTTPS client

# 해결 방법
$env:VAULT_ADDR="http://127.0.0.1:8200"