version: '3.3'
services:
  vault:
    image: vault:1.12.3
    container_name: vault
    ports:
      - "8200:8200"
    restart: always
    volumes:
      - ./logs:/vault/logs
      - ./file:/vault/date
      - ./config.hcl:/vault/config/config.hcl
      #- ./certs:/certs
    # vault 需要锁定内存以防止敏感值信息被交换(swapped)到磁盘中
    # 为此需要添加如下 capability
    cap_add:
      - IPC_LOCK
    entrypoint: vault server -config /vault/config/config.hcl

# 单机版
ui = true

listener "tcp" {
  tls_disable = 1
  address = "[::]:8200"
  cluster_address = "[::]:8201"
}
storage "file" {
  path = "/vault/data"
}

ui = true

// 使用文件做数据存储（单节点）
storage "raft" {
  path    = "/vault/date"
  node_id = "node1"
}

listener "tcp" {
  address = "[::]:8200"

  tls_disable = "true"

}

api_addr = "http://0.0.0.0/8200"
// ha 访问入口，不能写0.0.0.0
cluster_addr = "http://172.16.78.161:8201"

# 设置vault地址
[root@sugar vault]# export VAULT_ADDR='http://127.0.0.1:8200'

# 复制命令到宿主机
[root@sugar vault]# docker  cp vault:/bin/vault /usr/local/bin/vault
[root@sugar vault]# chmod +x /usr/local/bin/vault

[root@sugar vault]# vault operator init
vault operator init
Unseal Key 1: aTpDcs5FQ1GzklifRwYCKdLPHpCUvNm9EGhZ0NH8Ut0p
Unseal Key 2: 33V89ljeUr23AQpBgDANgFRzft+8f7E5KRXPDjsFpOG2
Unseal Key 3: OwfbdEA481baX8TZ0/kT49dBFg6ArXboVapBAd1y0fqk
Unseal Key 4: DD1Lp86WGqVq+18LwUdGPxb6cquTjSz/yAIc9fkYNzF9
Unseal Key 5: FrqRqQSlhb/sjj7h9Pcau5eqrB/rxtkFBbBJSfuv48IM

Initial Root Token: hvs.FTcALTSfrVuw9On8B2g2JQIl

Vault initialized with 5 key shares and a key threshold of 3. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 3 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated root key. Without at least 3 keys to
reconstruct the root key, Vault will remain permanently sealed!

It is possible to generate new unseal keys, provided you have a quorum of

[root@sugar vault]# vault operator unseal aTpDcs5FQ1GzklifRwYCKdLPHpCUvNm9EGhZ0NH8Ut0p
Key                Value
---                -----
Seal Type          shamir
Initialized        true
Sealed             true
Total Shares       5
Threshold          3
Unseal Progress    1/3
Unseal Nonce       8d5a33c3-bff5-e407-eb13-15c1457bdb63
Version            1.12.3
Build Date         2023-02-02T09:07:27Z
Storage Type       raft
HA Enabled         true



[root@sugar vault]# vault operator unseal OwfbdEA481baX8TZ0/kT49dBFg6ArXboVapBAd1y0fqk
Key                Value
---                -----
Seal Type          shamir
Initialized        true
Sealed             true
Total Shares       5
Threshold          3
Unseal Progress    2/3
Unseal Nonce       8d5a33c3-bff5-e407-eb13-15c1457bdb63
Version            1.12.3
Build Date         2023-02-02T09:07:27Z
Storage Type       raft
HA Enabled         true
[root@sugar vault]# vault operator unseal 'FrqRqQSlhb/sjj7h9Pcau5eqrB/rxtkFBbBJSfuv48IM'
Key                     Value
---                     -----
Seal Type               shamir
Initialized             true
Sealed                  false
Total Shares            5
Threshold               3
Version                 1.12.3
Build Date              2023-02-02T09:07:27Z
Storage Type            raft
Cluster Name            vault-cluster-8257ffed
Cluster ID              2eccf238-400e-1ba5-f491-321c1388c826
HA Enabled              true
HA Cluster              n/a
HA Mode                 standby
Active Node Address     <none>
Raft Committed Index    31
Raft Applied Index      31
[root@sugar vault]# vault status
Key                     Value
---                     -----
Seal Type               shamir
Initialized             true
Sealed                  false
Total Shares            5
Threshold               3
Version                 1.12.3
Build Date              2023-02-02T09:07:27Z
Storage Type            raft
Cluster Name            vault-cluster-8257ffed
Cluster ID              2eccf238-400e-1ba5-f491-321c1388c826
HA Enabled              true
HA Cluster              https://192.168.10.161:8201
HA Mode                 active
Active Since            2023-03-07T12:11:38.884017872Z
Raft Committed Index    36
Raft Applied Index      36

path "secret/foo" {
  capabilities = ["read"]
}

# This section grants all access on "secret/*". Further restrictions can be
# applied to this broad policy, as shown below.
path "secret/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Even though we allowed secret/*, this line explicitly denies
# secret/super-secret. This takes precedence.
path "secret/super-secret" {
  capabilities = ["deny"]
}

# Policies can also specify allowed, disallowed, and required parameters. Here
# the key "secret/restricted" can only contain "foo" (any value) and "bar" (one
# of "zip" or "zap").
path "secret/restricted" {
  capabilities = ["create"]
  allowed_parameters = {
    "foo" = []
    "bar" = ["zip", "zap"]
  }
}

# Permit reading only "secret/foo". An attached token cannot read "secret/food"
# or "secret/foo/bar".
path "secret/foo" {
  capabilities = ["read"]
}

# Permit reading everything under "secret/bar". An attached token could read
# "secret/bar/zip", "secret/bar/zip/zap", but not "secret/bars/zip".
path "secret/bar/*" {
  capabilities = ["read"]
}

# Permit reading everything prefixed with "zip-". An attached token could read
# "secret/zip-zap" or "secret/zip-zap/zong", but not "secret/zip/zap
path "secret/zip-*" {
  capabilities = ["read"]
}

# Permit reading the "teamb" path under any top-level path under secret/
path "secret/+/teamb" {
  capabilities = ["read"]
}

# Permit reading secret/foo/bar/teamb, secret/bar/foo/teamb, etc.
path "secret/+/+/teamb" {
  capabilities = ["read"]
}

# This requires the user to create "secret/foo" with a parameter named
# "bar" and "baz".
path "secret/foo" {
  capabilities = ["create"]
  required_parameters = ["bar", "baz"]
}

# This allows the user to create "secret/foo" with a parameter named
# "bar". It cannot contain any other parameters, but "bar" can contain
# any value.
path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = []
  }
}

# This allows the user to create "secret/foo" with a parameter named
# "bar". It cannot contain any other parameters, and "bar" can only
# contain the values "zip" or "zap".
path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = ["zip", "zap"]
  }
}

# This allows the user to create "secret/foo" with a parameter named
# "bar". The parameter "bar" can only contain the values "zip" or "zap",
# but any other parameters may be created with any value.
path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = ["zip", "zap"]
    "*"   = []
  }
}

# This allows the user to create or update "secret/foo" with a parameter
# named "bar". The values passed to parameter "bar" must start with "baz/"
# so values like "baz/quux" are fine. However, values like
# "baz/quux,wibble,wobble,wubble" would also be accepted. The API that
# underlies "secret/foo" might allow comma delimited values for the "bar"
# parameter, and if it did, specifying a value like
# "baz/quux,wibble,wobble,wubble" would result in 4 different values getting
# passed along. Seeing values like "wibble" or "wobble" getting passed to
# "secret/foo" might surprise someone that expected the allowed_parameters
# constraint to only allow values starting with "baz/".
path "secret/foo" {
  capabilities = ["create", "update"]
  allowed_parameters = {
    "bar" = ["baz/*"]
  }
}

# This allows the user to create "secret/foo" with any parameters not
# named "bar".
path "secret/foo" {
  capabilities = ["create"]
  denied_parameters = {
    "bar" = []
  }
}

# This allows the user to create "secret/foo" with a parameter named
# "bar". It can contain any other parameters, but "bar" cannot contain
# the values "zip" or "zap".
path "secret/foo" {
  capabilities = ["create"]
  denied_parameters = {
    "bar" = ["zip", "zap"]
  }
}

# This allows the user to create "secret/foo", but it cannot have any
# parameters.
path "secret/foo" {
  capabilities = ["create"]
  denied_parameters = {
    "*" = []
  }
}

path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = ["foo-*"]
  }
}

path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = ["*-foo"]
  }
}

# This effectively makes response wrapping mandatory for this path by setting min_wrapping_ttl to 1 second.
# This also sets this path's wrapped response maximum allowed TTL to 90 seconds.
path "auth/approle/role/my-role/secret-id" {
    capabilities = ["create", "update"]
    min_wrapping_ttl = "1s"
    max_wrapping_ttl = "90s"
}

$ vault read sys/policy/default
Key      Value
---      -----
name     default
rules    # Allow tokens to look up their own properties
path "auth/token/lookup-self" {
    capabilities = ["read"]
}

# Allow tokens to renew themselves
path "auth/token/renew-self" {
    capabilities = ["update"]
}

# Allow tokens to revoke themselves
path "auth/token/revoke-self" {
    capabilities = ["update"]
}

# Allow a token to look up its own capabilities on a path
path "sys/capabilities-self" {
    capabilities = ["update"]
}

# Allow a token to look up its own entity by id or name
path "identity/entity/id/{{identity.entity.id}}" {
  capabilities = ["read"]
}
path "identity/entity/name/{{identity.entity.name}}" {
  capabilities = ["read"]
}


# Allow a token to look up its resultant ACL from all policies. This is useful
# for UIs. It is an internal path because the format may change at any time
# based on how the internal ACL features and capabilities change.
path "sys/internal/ui/resultant-acl" {
    capabilities = ["read"]
}

# Allow a token to renew a lease via lease_id in the request body; old path for
# old clients, new path for newer
path "sys/renew" {
    capabilities = ["update"]
}
path "sys/leases/renew" {
    capabilities = ["update"]
}

# Allow looking up lease properties. This requires knowing the lease ID ahead
# of time and does not divulge any sensitive information.
path "sys/leases/lookup" {
    capabilities = ["update"]
}

# Allow a token to manage its own cubbyhole
path "cubbyhole/*" {
    capabilities = ["create", "read", "update", "delete", "list"]
}

# Allow a token to wrap arbitrary values in a response-wrapping token
path "sys/wrapping/wrap" {
    capabilities = ["update"]
}

# Allow a token to look up the creation time and TTL of a given
# response-wrapping token
path "sys/wrapping/lookup" {
    capabilities = ["update"]
}

# Allow a token to unwrap a response-wrapping token. This is a convenience to
# avoid client token swapping since this is also part of the response wrapping
# policy.
path "sys/wrapping/unwrap" {
    capabilities = ["update"]
}

# Allow general purpose tools
path "sys/tools/hash" {
    capabilities = ["update"]
}
path "sys/tools/hash/*" {
    capabilities = ["update"]
}

# Allow checking the status of a Control Group request if the user has the
# accessor
path "sys/control-group/request" {
    capabilities = ["update"]
}

$ curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data '{"no_default_policy": "true"}' \
  https://vault.hashicorp.rocks/v1/auth/token/create

$ curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data '{"token": "<token>"}' \
  https://vault.hashicorp.rocks/v1/auth/token/revoke

$ vault read sys/policy

$ vault policy write policy-name policy-file.hcl

# http
$ curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data '{"policy":"path \"...\" {...} "}' \
  https://vault.hashicorp.rocks/v1/sys/policy/policy-name
  

# 这两个例子里，策略的名称都是 policy-name。你可以把策略名理解成指向策略规则的指针。令牌通过策略名关联相关策略规则。

$ vault write my-existing-policy updated-policy.json

# http
$ curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data '{"policy":"path \"...\" {...} "}' \
  https://vault.hashicorp.rocks/v1/sys/policy/my-existing-policy

$ vault delete sys/policy/policy-name

# http
$ curl \
  --request DELETE \
  --header "X-Vault-Token: ..." \
  https://vault.hashicorp.rocks/v1/sys/policy/policy-name


# 删除是一个幂等操作。删除一个不存在的策略不会导致Vault返回错误。

# 开启用户登录
vault auth enable userpass

# http 方式开启
$ curl \
  --request DELETE \
  --header "X-Vault-Token: ..." \
  https://vault.hashicorp.rocks/v1/sys/policy/policy-name

curl -XPOST -s -H "X-Vault-Token: xxxxx" "http://vault.local.com/v1/sys/auth/userpass" -d'{"type": "userpass"}'

# 创建sethvargo用户，并设置密码和策略
$ vault write auth/userpass/users/sethvargo \
    password="s3cr3t!" \
    policies="dev-readonly,logs"

$ vault login -method="userpass" username="sethvargo"
Password (will be hidden): ...

$ vault token create -policy=dev-readonly -policy=logs

terraform {
  required_providers {
    vault = {
      source = "hashicorp/vault"
    }
  }
}

provider "vault" {
  address = var.vault-init.url
  token   = var.vault-init.token

}


resource "vault_mount" "secret_path" {
  for_each = var.vault-init.secret_path

  path        = each.value.path
  type        = each.value.type
  description = each.value.description
  options = {
    version = "1"
  }
}


resource "vault_policy" "policy" {
  for_each = var.vault-init.policy
  name     = each.key

  policy = each.value.policy

}

resource "vault_auth_backend" "userpass" {
  type = "userpass"
}


resource "vault_generic_endpoint" "create_user" {
  for_each = var.vault-init.userlist

  path                 = "auth/userpass/users/${each.key}"
  ignore_absent_fields = true
  data_json            = jsonencode(each.value)

  depends_on = [
    vault_auth_backend.userpass,
    vault_policy.policy
  ]
}

resource "vault_generic_secret" "secret_value" {
  for_each = var.vault-init.secret_value

  path      = "${each.value.path}/${each.key}"
  data_json = jsonencode(each.value.data)
  depends_on = [
    vault_mount.secret_path,
    vault_policy.policy
  ]
}

variable "vault-init" {
  type = any
  default = {
    url          = null
    token        = null
    secret_path  = {}
    userlist     = {}
    policy       = {}
    secret_value = {}
  }
}

vault-init = {

  url = "http://127.0.0.1:8200"

  token = "cccccccccc"


  secret_path = {
    p2 = {
      path        = "Monitor"
      type        = "kv"
      description = "Metrics/Tracing/Logs"
    },
    p5 = {
      path        = "APP"
      type        = "kv"
      description = "Gitea/Gitlab"
    }
  }

  policy = {
    admin = {
      policy = <<EOT
path "cubbyhole/*" {
  capabilities = ["deny"]
}
path "sys/auth" {
  capabilities = ["read"]
}
path "auth/userpass/users/*" {
  capabilities = ["list", "read", "update"]
}
path "Monitor/+" {
  capabilities = ["read", "list"]
}
path "APP/+" {
  capabilities = ["read", "list", "update", "patch"]
}
path "APP/+/+" {
  capabilities = ["read", "list"]
}

EOT
    },
    user = {
      policy = <<EOT
path "cubbyhole/*" {
  capabilities = ["deny"]
}
path "Hardware/+" {
  capabilities = ["deny"]
}
path "Monitor/+" {
  capabilities = ["read", "list"]
}
EOT
    }

  }

  userlist = {
    user = {
      username = "user",
      password = "hello_world",
      policies = ["user"]
    },
    admin = {
      username = "admin",
      password = "hello_world",
      policies = ["admin"]
    }
  }


  secret_value = {
    Grafana = {
      path = "Monitor"
      data = {
  "External Address"= "http://grafana.local.com",
  "Password"= "CvcTKkm4xxxxxxxxx",
  "Username"= "admin"
}


    }
  }
}

terraform {
  required_providers {
    helm = {
      source  = "hashicorp/helm"
    }
    shell = {
      source  = "scottwinkler/shell"
      version = "1.7.10"
    }
  }

}


module "vault" {
  count  = var.vault.enabled ? 1 : 0
  source = "xxxx"
  xxxxx
}

resource "shell_script" "vault_init" {
  count  = var.vault.enabled ? 1 : 0
  lifecycle_commands {
    create = <<EOF
      sleep 50
      kubectl -n ${module.vault[0].namespace} exec vault-0 -- vault operator init -key-shares=6  -key-threshold=3 -format=json
    EOF
    delete = ""
  }
  environment = {
    KUBECONFIG = var.kubeconfig
  }
  depends_on = [
    module.vault,
    ]
}

resource "shell_script" "vault_unseal" {
  count = var.vault.enabled ? 1 : 0
  lifecycle_commands {
    create = <<EOF
      kubectl -n ${module.vault[0].namespace} exec vault-0 -- vault operator unseal ${jsondecode(shell_script.vault_init[0].output.unseal_keys_b64)[0]}
      kubectl -n ${module.vault[0].namespace} exec vault-0 -- vault operator unseal ${jsondecode(shell_script.vault_init[0].output.unseal_keys_b64)[1]}
      kubectl -n ${module.vault[0].namespace} exec vault-0 -- vault operator unseal ${jsondecode(shell_script.vault_init[0].output.unseal_keys_b64)[2]}
    EOF
    delete = ""
  }
  environment = {
    KUBECONFIG = var.kubeconfig
  }
  depends_on = [module.vault]
}