136 lines
2.8 KiB
Markdown
136 lines
2.8 KiB
Markdown
# Vault configuration
|
|
|
|
## Introduction
|
|
|
|
This document describes how to create vault tokens in order to restrict components access to vault as following
|
|
|
|
| Component | Abilities |
|
|
| ------------ | ------------------------------------------------------- |
|
|
| barong-rails | encrypt api keys<br />create TOTP<br />verify TOTP code |
|
|
| barong-authz | decrypt api keys |
|
|
|
|
|
|
|
|
## Connect to vault
|
|
The the following variables in your environment with correct values:
|
|
|
|
```bash
|
|
export VAULT_ADDR='http://127.0.0.1:8200'
|
|
export VAULT_TOKEN='s.ozytsgX1BcTQaR5Y07SAd2VE'
|
|
```
|
|
|
|
You can test that it works running the following command:
|
|
|
|
```
|
|
$ vault status
|
|
Type: shamir
|
|
Sealed: false
|
|
Key Shares: 1
|
|
Key Threshold: 1
|
|
Unseal Progress: 0
|
|
Unseal Nonce:
|
|
Version: 1.3.4
|
|
Cluster Name: vault-cluster-650930cf
|
|
Cluster ID: 9f40327d-ec71-9655-b728-7588ce47d0b4
|
|
|
|
High-Availability Enabled: false
|
|
```
|
|
|
|
## Create ACL groups
|
|
|
|
### Create the following policy files
|
|
|
|
**barong-rails.hcl**
|
|
|
|
Replace *opendax* with your vault application name. See [barong vault configuration](https://www.openware.com/sdk/docs/barong/configuration.html#vault-configuration) for more details.
|
|
|
|
```bash
|
|
# Access system health status
|
|
path "sys/health" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
# Manage the transit secrets engine
|
|
path "transit/keys/*" {
|
|
capabilities = [ "create", "read", "list" ]
|
|
}
|
|
|
|
# Encrypt engines secrets
|
|
path "transit/encrypt/opendax_apikeys_*" {
|
|
capabilities = [ "create", "read", "update" ]
|
|
}
|
|
|
|
# Renew tokens
|
|
path "auth/token/renew" {
|
|
capabilities = [ "update" ]
|
|
}
|
|
|
|
# Lookup tokens
|
|
path "auth/token/lookup" {
|
|
capabilities = [ "update" ]
|
|
}
|
|
|
|
# Manage otp keys
|
|
path "totp/keys/opendax_*" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
# Verify an otp code
|
|
path "totp/code/opendax_*" {
|
|
capabilities = ["update"]
|
|
}
|
|
```
|
|
|
|
**barong-authz.hcl**
|
|
|
|
```bash
|
|
# Access system health status
|
|
path "sys/health" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
# Manage the transit secrets engine
|
|
path "transit/keys/*" {
|
|
capabilities = [ "create", "read", "list" ]
|
|
}
|
|
|
|
# Decrypt engines secrets
|
|
path "transit/decrypt/opendax_apikeys_*" {
|
|
capabilities = [ "create", "read", "update" ]
|
|
}
|
|
|
|
# Renew tokens
|
|
path "auth/token/renew" {
|
|
capabilities = [ "update" ]
|
|
}
|
|
|
|
# Lookup tokens
|
|
path "auth/token/lookup" {
|
|
capabilities = [ "update" ]
|
|
}
|
|
```
|
|
|
|
### Create the ACL groups in vault
|
|
|
|
```bash
|
|
vault policy write barong-rails barong-rails.hcl
|
|
vault policy write barong-authz barong-authz.hcl
|
|
```
|
|
|
|
### Create applications tokens
|
|
|
|
```bash
|
|
vault token create -policy=barong-rails -period=240h
|
|
vault token create -policy=barong-authz -period=240h
|
|
```
|
|
|
|
## Configure Barong
|
|
|
|
Set those variables according to your deployment:
|
|
|
|
```bash
|
|
export BARONG_VAULT_ADDRESS=http://127.0.0.1:8200
|
|
export BARONG_VAULT_TOKEN=s.jyH1vmrOmkZ0FZZ0NZtgRenS
|
|
export BARONG_VAULT_APP_NAME=opendax
|
|
```
|