HashiCorp Vault の基本から上級まで

パート 1: HashiCorp Vault プラットフォーム

xdev.asia

1。 Linux に Vault をインストール

Ubuntu/Debian

# Thêm HashiCorp GPG key
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
Thêm repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
Cài đặt Vault
sudo apt update && sudo apt install vault
Xác nhận cài đặt
vault version
Vault v1.21.x

CentOS/RHEL

# Thêm repository
sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
Cài đặt Vault
sudo yum install vault
vault version

macOS

# Sử dụng Homebrew
brew tap hashicorp/tap
brew install hashicorp/tap/vault
vault version

2。 Vault 開発サーバーを実行

Dev サーバーは開発モードであり、すべてのデータはメモリに保存され、TLS は無効になり、自動シール解除されます:

# Khởi chạy Dev Server
vault server -dev

# Output sẽ hiển thị:
# Unseal Key: ...
# Root Token: hvs.xxxxx

# Trong terminal khác, export environment variables
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='hvs.xxxxx'

# Kiểm tra trạng thái
vault status

3。構成の制作

Vault 構成ファイル (vault.hcl)

# /etc/vault.d/vault.hcl
Storage Backend - Integrated Storage (Raft)
storage "raft" {
path    = "/opt/vault/data"
node_id = "vault-node-1"
}
Listener - TCP với TLS
listener "tcp" {
address     = "0.0.0.0:8200"
tls_cert_file = "/opt/vault/tls/vault-cert.pem"
tls_key_file  = "/opt/vault/tls/vault-key.pem"
}
API Address
api_addr     = "https://vault.example.com:8200"
cluster_addr = "https://vault.example.com:8201"
UI
ui = true
Disable mlock (recommended cho containers)
disable_mlock = true
Telemetry
telemetry {
prometheus_retention_time = "30s"
disable_hostname         = true
}

Systemd Service

# /etc/systemd/system/vault.service
[Unit]
Description=HashiCorp Vault
Documentation=https://developer.hashicorp.com/vault/docs
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
[Service]
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
LimitNOFILE=65536
LimitMEMLOCK=infinity
[Install]
WantedBy=multi-user.target

4。 Docker Compose を使用した Vault

# docker-compose.yml
services:
  vault:
    image: hashicorp/vault:1.21
    container_name: vault
    restart: unless-stopped
    ports:
      - "8200:8200"
    environment:
      VAULT_ADDR: "http://0.0.0.0:8200"
      VAULT_API_ADDR: "http://0.0.0.0:8200"
    volumes:
      - vault-data:/vault/data
      - ./config:/vault/config
    cap_add:
      - IPC_LOCK
    command: vault server -config=/vault/config/vault.hcl

volumes:
  vault-data:

5。 Vault の初期化 (Operator Init)

# Khởi tạo Vault lần đầu
vault operator init

# Output:
# Unseal Key 1: xxx
# Unseal Key 2: xxx
# Unseal Key 3: xxx
# Unseal Key 4: xxx
# Unseal Key 5: xxx
# Initial Root Token: hvs.xxxxx

# Unseal Vault (cần 3 trong 5 keys mặc định)
vault operator unseal <key-1>
vault operator unseal <key-2>
vault operator unseal <key-3>

# Custom key shares và threshold
vault operator init -key-shares=3 -key-threshold=2

# Kiểm tra trạng thái
vault status
# Sealed: false
# HA Enabled: true

6。 Helm

を使用して Kubernetes に Vault をデプロイする

# Thêm Helm repo
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update

# Cài đặt Vault standalone
helm install vault hashicorp/vault \
  --set "server.dev.enabled=false" \
  --set "server.ha.enabled=true" \
  --set "server.ha.replicas=3" \
  --set "server.ha.raft.enabled=true"

# Khởi tạo Vault trong Kubernetes
kubectl exec vault-0 -- vault operator init
kubectl exec vault-0 -- vault operator unseal <key>

7。概要

この記事では、ベア メタル Linux から Docker や Kubernetes まで、さまざまなプラットフォームに Vault をインストールする方法を学びました。重要な点は、開発サーバー (テストのみ) と運用モード (TLS、永続ストレージ、適切な初期化/シール解除が必要) の違いを理解することです。次の記事では、Vault CLI、API、および Web UI について詳しく説明します。