Skip to content

Commit 4b6d193

Browse files
rod4n4m1rod4n4m1
committed
added vault server setup
Signed-off-by: Rod Anami <[email protected]>
1 parent 2bcf70d commit 4b6d193

File tree

5 files changed

+243
-1
lines changed

5 files changed

+243
-1
lines changed

‎container/setup/ca.crt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDxTCCAq2gAwIBAgIUAlxtfrFKdrJi2LzJg1NGTdkTIlwwDQYJKoZIhvcNAQEL
3+
BQAwIDEeMBwGA1UEAxMVY2hhdG9wc2tuaWdodC5pYm0uY29tMB4XDTIwMDYyOTIw
4+
NTAzN1oXDTMwMDYyNzIwNTEwN1owIDEeMBwGA1UEAxMVY2hhdG9wc2tuaWdodC5p
5+
Ym0uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1GxGeJF30YQh
6+
SvzneydNiODPEw9yBrM0CMUw5o68C1lgbCzwtZB95RyuiPqUl9AASoFtTVDEDX10
7+
5WBD1obMMsAYyGr+1bxUq9lQ9ldjjFlBUjrzlNXL5fDLfjJ5jFKMMH5lrZ3LvYZD
8+
JZbupf0Qc9RLcybi4nBS8PuACM16C8AVVr/xd7q9mwdmqnC0eJCV4c/A/+3aVi+/
9+
ZOXgm4ftoalOP7PDIscYf2HxZkvlLstWE3URU9EIVXoWp8t9vFSYVYLlNBymv28I
10+
zIMKDBrLpc8WGPBN2i973MBBI+5TnHwfSCIcyWl83g3ILKyr2SS30XY8A0KR8xpH
11+
0whF9sKQpQIDAQABo4H2MIHzMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTAD
12+
AQH/MB0GA1UdDgQWBBQyiAYB5D74ZTdbQKWsCW3gwDsOYjAfBgNVHSMEGDAWgBQy
13+
iAYB5D74ZTdbQKWsCW3gwDsOYjA7BggrBgEFBQcBAQQvMC0wKwYIKwYBBQUHMAKG
14+
H2h0dHA6Ly8xMjcuMC4wLjE6ODIwMC92MS9wa2kvY2EwIAYDVR0RBBkwF4IVY2hh
15+
dG9wc2tuaWdodC5pYm0uY29tMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly8xMjcu
16+
MC4wLjE6ODIwMC92MS9wa2kvY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQBNeXbKUJ5C
17+
SlseWTdP2c2NSqMy3T9c2DEz6C8PGiEnWTqCRd5gQCj0EPkVI18xK8AhR4g0wjjA
18+
nRMT2YSFXdKQbQgq3tRyb2p+FyZTTvsSlu6/yIbxFnjg8t8KorlWq/8iKoaToZzz
19+
86GAQRRBRoD9I3FCQSak2Zj1wVoNvYxcSkjuMACNpM4sqKWVSwqv0GwBh6x/7peh
20+
r85aRfeOE4iqwe++B6/D9NR80Awk3xU25yVnP8XTNvsddCUcChr3ORD3ZYFmpODA
21+
5WchUnGITNA2zZ+dEXN7YgEtiKMNzp4xTNVtH7e5SCwB0wepy6XVh8vsKIQiL6qe
22+
1Z3l5jBiaYnK
23+
-----END CERTIFICATE-----

‎container/setup/vault-config.sh

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
#!/usr/bin/env bash
2+
3+
## Important notice
4+
## This shell script configures the Vault server with the following:
5+
## - Root CA certificate
6+
## - Intermediate CA certificate
7+
## - PKI role
8+
## - AppRole auth method
9+
## - Token auth method
10+
## - KV v2 secret engine
11+
## - LDAP auth method
12+
## - Active Directory secret engine
13+
## - Userpass auth method
14+
## - TLS Certificate auth method
15+
## - Certificates for authentication
16+
## - Policies for the certificates
17+
## - Provisioner / Admin / Knight tokens
18+
## - TOTP secret engine
19+
## This script should be used as model for configuring an dev/test environment,
20+
## and should NEVER used in production.
21+
##
22+
23+
# Create standard policies
24+
vault policy write admin ./policies/admin-policy.hcl
25+
vault policy write provisioner ./policies/provisioner-policy.hcl
26+
27+
# Enable PKI secret engine
28+
vault secrets enable pki
29+
30+
# Configure PKI TTL
31+
vault secrets tune -max-lease-ttl="87600h" pki
32+
33+
# Create root CA certificate
34+
vault write -field=certificate pki/root/generate/internal \
35+
common_name="chatopsknight.ibm.com,default.svc.cluster.local" \
36+
ttl="87600h" > CA_cert.crt
37+
38+
# Enable Intermediary PKI
39+
vault secrets enable -path=pki_int pki
40+
41+
# Configure Intermediary PKI TTL
42+
vault secrets tune -max-lease-ttl="87600h" pki_int
43+
44+
# Create intermediate CSR
45+
vault write -format=json pki_int/intermediate/generate/internal \
46+
common_name="chatopsknight.ibm.com Intermediate Authority" \
47+
| jq -r '.data.csr' > pki_intermediate.csr
48+
49+
# Sign intermediate Certificate
50+
vault write -format=json pki/root/sign-intermediate csr=@pki_intermediate.csr \
51+
format=pem_bundle ttl="87600h" \
52+
| jq -r '.data.certificate' > intermediate.cert.pem
53+
54+
# Set intermediate certificate signed by root CA
55+
vault write pki_int/intermediate/set-signed [email protected]
56+
57+
# Create a role
58+
vault write pki_int/roles/chatopsknight \
59+
allowed_domains="chatopsknight.kyndryl.net" \
60+
allow_subdomains=true \
61+
max_ttl="87600h"
62+
63+
# Issue new certificate
64+
vault write pki_int/issue/chatopsknight common_name="vault.chatopsknight.kyndryl.net" ttl="87500h"
65+
66+
# Create a policy
67+
vault policy write knight-vault ./policies/chatops-knight-vault.hcl
68+
69+
# Apply policy to role for AppRole auth method
70+
vault write auth/approle/role/knight secret_id_ttl="720h" token_ttl="12h" token_max_tll="12h" policies="knight-vault"
71+
72+
# Apply policy to role for Token auth method
73+
vault write auth/token/roles/knight token_explicit_max_ttl=43200 allowed_policies="knight-vault"
74+
75+
# Check role-id
76+
vault read auth/approle/role/knight/role-id
77+
78+
# Create new secret-id
79+
vault write -f auth/approle/role/knight/secret-id
80+
81+
# Check if pair role-id and secret-id are working
82+
vault write auth/approle/login -field=token role_id=${ROLE_ID} secret_id=${SECRET_ID}
83+
84+
# Update issuing and clr points to use https
85+
vault write pki/config/urls \
86+
issuing_certificates="https://127.0.0.1:8200/v1/pki/ca" \
87+
crl_distribution_points="https://127.0.0.1:8200/v1/pki/crl"
88+
89+
# Enable KV v2 secret engine for the app
90+
vault secrets enable -path=knight kv-v2
91+
92+
# Enable LDAP auth method
93+
vault auth enable ldap
94+
95+
# Enable Active Directory secret engine
96+
vault secrets enable ad
97+
98+
# Download mock OpenLDAP CA certificates chain
99+
openssl s_client -showcerts -verify 5 -connect ldap.chatopsknight.com:636 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".pem"; print >out}'
100+
cat cert?.pem > ldap-server.pem
101+
rm cert?.pem
102+
103+
# Configure LDAP auth method for authentication
104+
vault write auth/ldap/config \
105+
url="ldaps://ldap.chatopsknight.com:636" \
106+
userattr="uid"\
107+
userdn="ou=Employees,dc=chatopsknight,dc=com" \
108+
groupdn="ou=Groups,dc=chatopsknight,dc=com" \
109+
discoverdn=false \
110+
[email protected] \
111+
insecure_tls=false \
112+
starttls=false
113+
114+
vault write auth/ldap/groups/provisioners policies="provisioner"
115+
vault write auth/ldap/groups/admins policies="admin"
116+
vault write auth/ldap/users/jane.doe groups="admins"
117+
118+
# Configure AD secret engine
119+
120+
vault write ad/config \
121+
binddn='cn=admin,dc=chatopsknight,dc=com' \
122+
bindpass='LD@PS3cr3t!' \
123+
url=ldaps://ldap.chatopsknight.com \
124+
userdn='dc=chatopsknight,dc=com' \
125+
[email protected] \
126+
insecure_tls=false
127+
128+
vault write ad/library/sre-team \
129+
[email protected],[email protected] \
130+
ttl=10h \
131+
max_ttl=20h \
132+
disable_check_in_enforcement=false
133+
134+
# Configure Userpass auth method
135+
vault auth enable userpass
136+
137+
vault write auth/userpass/users/nathan.hale password="r3s1st@anc3" policies="admin"
138+
139+
# Create Provisioner / Admin / Knight tokens
140+
vault token create -policy="provisioner"
141+
vault token create -policy="admin"
142+
vault token create -policy="knight-vault"
143+
144+
# Enable TLS Certificate auth method
145+
vault auth enable cert
146+
147+
# Create a PKI role to issue certificates
148+
vault write pki_int/roles/vault-cert \
149+
allow_any_name=true \
150+
max_ttl=720h \
151+
generate_lease=true
152+
153+
# Create a policy for the certificates issued
154+
vault policy write cert-policy ./policies/cert-policy.hcl
155+
156+
# Issue a certificate based on the create role
157+
vault write -format=json pki_int/issue/vault-cert \
158+
common_name=vault-cert | tee \
159+
>(jq -r .data.certificate > vault-cert-certificate.pem) \
160+
>(jq -r .data.issuing_ca > vault-cert-issuing-ca.pem) \
161+
>(jq -r .data.private_key > vault-cert-private-key.pem)
162+
163+
# Create a cert for authentication
164+
vault write auth/cert/certs/vault-cert \
165+
display_name=vault-cert \
166+
policies=cert \
167+
[email protected]
168+
169+
# Test cert login
170+
vault login -method=cert -client-cert=vault-cert-certificate.pem \
171+
-client-key=vault-cert-private-key.pem
172+
173+
curl --request POST --cacert /Users/rodanami/github/chatops-knight/hashi-vault/kubernetes/certs/ca.crt --cert /Users/rodanami/github/chatops-knight/hashi-vault/kubernetes/certs/vault.crt --key /Users/rodanami/github/chatops-knight/hashi-vault/kubernetes/certs/vault.key --data @payload.json https://vault.chatopsknight.ibm.com:8200/v1/auth/cert/login
174+
175+
# Configure TOTP secret engine
176+
177+
vault secrets enable totp
178+
179+
# End

‎container/setup/vault-init.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
3+
## Important notice
4+
## This shell script initiates the Vault server with the following:
5+
## - SHAMIR secret sharing with 6 keys and 3 threshold
6+
## This script should be used as model for configuring an dev/test environment,
7+
## and should NEVER used in production.
8+
##
9+
10+
vault operator init -key-shares=6 -key-threshold=3

‎container/setup/vault-unsealer.sh

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env bash
2+
3+
## Important notice
4+
## This shell script unseals the Vault server with the following:
5+
## - Unseal the vault with 3 keys from the 6 available keys without any protection
6+
## or key isolation
7+
## This script should be used as model for configuring an dev/test environment,
8+
## and should NEVER used in production.
9+
##
10+
11+
export VAULT_ADDR=https://vault.chatopsknight.ibm.com:8200
12+
export VAULT_CACERT=ca.crt
13+
14+
source vault-seals.env
15+
16+
# it requires at least 3 keys from the existing 6 to unseal the vault
17+
vault operator unseal $VAULT_UNSEAL_KEY1
18+
vault operator unseal $VAULT_UNSEAL_KEY3
19+
vault operator unseal $VAULT_UNSEAL_KEY5
20+
# Log as root after the vault is unsealed
21+
vault login $VAULT_ROOT_TOKEN

‎docs/Test-environment.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,7 @@ api_addr = "http://127.0.0.1:8200"
246246
EOF
247247
```
248248

249-
## Create an AppRole with role_id and secret_id
249+
### Create an AppRole with role_id and secret_id
250250

251251
```shell
252252
# Policy indicates the permissions and scopes an AppRole will have
@@ -333,6 +333,7 @@ vault login -method=cert -client-cert=vault-cert-certificate.pem \
333333
## Enable AD secret engine and configure it
334334

335335
```shell
336+
vault secrets enable ad
336337
vault write ad/config \
337338
binddn="cn=admin,dc=chatopsknight,dc=com" \
338339
bindpass=$LDAP_ADMIN_PASSWORD \
@@ -341,3 +342,11 @@ vault write ad/config \
341342
[email protected] \
342343
insecure_tls=false
343344
```
345+
346+
## Enable TOTP secret engine
347+
348+
```shell
349+
vault secrets enable totp
350+
```
351+
352+
## End

0 commit comments

Comments
 (0)