stenio123

This code shows the steps to enable the transit secret engine, configure a key, and use the sign leveraging Vault.

vault secrets enable transit

# Default key type doesn't support signing
vault write -f transit/keys/my-key type=rsa-4096

# Encode a string as base64
echo -n 'This was created by Stenio, you can trust me!' | openssl base64

stenio123

Demo

Browser:

• https://awwapp.com
• https://github.com/hashicorp/terraform-aws-nomad/tree/publish-amis/examples/nomad-consul-separate-cluster
• https://app.terraform.io/
• https://console.aws.amazon.com/
• http://NOMAD_SERVER_IP:4646/ui/jobs
• http://CONSUL_SERVER_IP:8500/ui/us-east-1/services
• https://github.com/stenio123/nomad-guides/tree/master/example-jobs

stenio123

# start vault in dev mode
VAULT_UI=true vault server -dev -dev-root-token-id="password"

# write some secrets for our example usage
curl --request POST \
     --silent \
     --header "X-Vault-Token: password" \
     --header "Content-Type: application/json" \
     --data '{ "options": { "cas": 0 }, "data": { "username": "administrator", "password": "hunter2" } }' \
     http://127.0.0.1:8200/v1/secret/data/dev | jq '.'

stenio123

Vault Namespaces Demo

Vault Namespaces supports a variety of ways of interacting with Vault.

# Config
vault namespace create marketing

echo '
path "secret/*" {
    capabilities = ["create", "read", "update", "delete", "list", "sudo"]

stenio123

Cubbyhole Single Use Secret

By leveraging the Cubbyhole secret engine, we can store a secret that only one token can retrieve. Once that token is expired or revoked, the secret is gone. When creating the token, you can limit number of uses.

# Creates token that will be shared. It will be used once to write a secret, second time to read then it is revoked
vault token create -use-limit=2 -policy=default -metadata="name=stenio"
# Output -<TOKEN>

stenio123

PKI Secret Engine

Create Limited Policy and Token for this demo

cat > pki.policy <<EOA
# Enable secrets engine
path "sys/mounts/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

stenio123

Vault Examples

Examples highligthing different Vault features.

To have a list of valid CLI flags, use

vault -h
vault <FEATURE> -h

HA Replication

stenio123

1. Clone git repository:

git clone [email protected]:stenio123/vault-ruby.git

2. Move to desired branch:

git checkout added-namespaces

stenio123

Enable AppRole

vault enable approle

Create role, and specify number of times SecretId can be used

vault write auth/approle/role/my-role     secret_id_ttl=10m     token_num_uses=10     token_ttl=20m     token_max_ttl=30m     secret_id_num_uses=40

stenio123

New test

# Mount database backend
vault mount database

# Configure MySQL connection
vault write database/config/mysql \
    plugin_name=mysql-legacy-database-plugin \
    connection_url="vaultadmin:vaultadminpassword@tcp(127.0.0.1:3306)/" \
    allowed_roles="readonly"