# 查看成员健康度
vault operator raft list-peers

Node     Address       State     Voter
----     -------       -----     -----
node1    vault:8201    leader    true

# 如果指定了这个变量, 会强制运行在开发模式下, 没有持久化
VAULT_DEV_ROOT_TOKEN_ID=

docker exec -it vault-server sh
export VAULT_ADDR=http://127.0.0.1:8200;

# 会生成 5 个 unseal key 和 1 个 root token, 务必保存
vault operator init

# 解封 - 并按提示输入任意 3 个 unsealKey
vault operator unseal

# 重新生成恢复密钥 - 需要多数旧的恢复密钥, Vault 会输出 5 个全新的 Recovery Keys
vault operator rekey -target=recovery

# 重新生成恢复密钥 - 到达阈值后才会有输出
vault operator rekey -init -key-shares=5 -key-threshold=3

vault operator init \
    -key-shares=5 \
    -key-threshold=3 \
    -pgp-keys="user1.asc,user2.asc,user3.asc,user4.asc,user5.asc"

vault operator init

# 撤销 token
vault token revoke <TOKEN_VALUE>

# 利用 Recovery Keys 重新生成 root token
# 系统会返回一个 Nonce 值和 OTP (One-Time Password)
vault operator generate-root -init

# 提供 Recovery Keys 签名, 需要多个管理员输入足够数量的 Recovery Keys
vault operator generate-root -recovery-key

# 解码获取新 Token:
# 最后一步会输出一个加密的 Token 字符串, 结合第 1 步的 OTP 即可解密出真实的 hvs.root-xxx

export VAULT_ADDR='http://192.168.5.9:8200'
export VAULT_TOKEN='xxxxxxxxxxxxxewofoeiwoiieo'

vault status        # 运行状态

# write
vault kv put secret/myapp/config \
    db_username="admin" \
    db_password="very-secret-password" \
    timeout="5s"

# read
vault kv get secret/myapp/config

# modify
vault kv patch secret/myapp/config timeout="10s"

vault kv metadata get secret/myapp/config       # 查看版本历史
vault kv get -version=1 secret/myapp/config     # 读取旧版本 (版本 1)

# 查看已经开启的认证方法
vault auth list
Path         Type        Accessor                  Description                Version
----         ----        --------                  -----------                -------
approle/     approle     auth_approle_f18cd096     n/a                        n/a
token/       token       auth_token_ecd6971e       token based credentials    n/a
userpass/    userpass    auth_userpass_42108dc7    n/a                        n/a

# token 是已经签发的token, 不能直接列出

vault write auth/userpass/users/user1 password=passw0rd

vault login -method=userpass username=bob password=foobar

vault list auth/userpass/users
vault list auth/approle/role/

helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update
helm install vault-secrets-operator hashicorp/vault-secrets-operator \
  --namespace vault-secrets-operator-system \
  --create-namespace

# 示例: VaultAuth 资源
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: static-auth
  namespace: default
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: database   # 对应在 Vault 中创建的 role 名称
    serviceAccount: my-app-sa # VSO 将使用的 ServiceAccount

# 示例: VaultStaticSecret 资源
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: myapp-static-secret
  namespace: default
spec:
  type: kv-v2                     # 使用 KV V2 引擎
  mount: secret                   # Vault 中的挂载路径
  path: myapp/config              # Vault 中的 Secret 路径
  destination:
    name: myapp-k8s-secret        # 生成的 Kubernetes Secret 名称
    create: true                  # 自动创建 Secret
  refreshAfter: 1h                # 定期从 Vault 拉取最新数据, 每小时同步一次

# 启用数据库引擎
vault secrets enable database

vault write database/config/my-db \
    plugin_name=postgresql-database-plugin \
    allowed_roles="my-role" \
    connection_url="postgresql://{{username}}:{{password}}@localhost:5432/postgres?sslmode=disable" \
    username="postgres" \
    password="root-password"

vault write database/roles/my-role \
    db_name=my-db \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="1h" \
    max_ttl="24h"

vault read database/creds/my-role

spring:
  cloud:
    vault:
      uri: http://localhost:8200
      token: ${VAULT_TOKEN}
      kv:
        enabled: true
        backend: secret
        default-context: myapp/config

# 查看状态, 是否封锁和解封
curl https://vault.services.wait/v1/sys/seal-status

# API 可用性验证
curl http://IP:8200/v1/sys/health  # 返回包含 initialized 和 sealed 状态的 JSON

# 开启 AppRole 认证
vault auth enable approle

vault delete auth/approle/role/terraform-role

# 创建角色并绑定策略 - auth/approle/role/terraform-role
vault write auth/approle/role/terraform-role \
    secret_id_ttl=0 \   # SecretID 自身的有效期
    secret_id_num_uses=0 \      # SecretID 使用次数限制
    token_type=service \        # 默认就是 service
    token_num_uses=0 \
    token_ttl=1h \      # Token 产生后的初始有效期
    token_max_ttl=3h \  # Token 允许被续期到的最长总时长, batch 类型的 Token 不可续期
    token_policies="admin-readonly"

# 获取 role-id
vault read auth/approle/role/homelab-app1/role-id

# 创建/获取 Secret ID
vault write -f auth/approle/role/homelab-app1/secret-id

## 登录
vault write auth/approle/login \
    role_id="ae7830a4-ee10-3e84-b186-770b286b51b4" \
    secret_id="f8268b33-6b96-d08f-bcb7-0c959dcd09bd"

# 响应 json 里面有 client_token 字段
# 也可以通过 vault token lookup 查看认证和 token


curl \
    --request POST \
    --data '{"role_id":"ae7830a4-ee10-3e84-b186-770b286b51b4","secret_id":"f8268b33-6b96-d08f-bcb7-0c959dcd09bd"}' \
    https://vault.services.wait/v1/auth/approle/login

wait@ub05:~$ vault read auth/approle/role/homelab-app1/role-id
Key        Value
---        -----
role_id    3211340e-fe90-3236-36fe-ff7100763cf2
wait@ub05:~$
wait@ub05:~$ vault write -f auth/approle/role/homelab-app1/secret-id
Key                   Value
---                   -----
secret_id             b4d8c662-0042-040a-0527-dbbbe3acec90  # 密码
secret_id_accessor    b86c5e6d-880f-32e4-279b-eaf19151bc5b  # 访问器/工号
secret_id_num_uses    0
secret_id_ttl         0s

vault write auth/approle/role/homelab-app1/secret-id-accessor/destroy accessor=b86c5e6dxxx

vault write auth/approle/role/homelab-node \
    secret_id_num_uses=0 \
    secret_id_ttl="0" \

    # 核心限制：只允许来自 指定 的 IP 请求登录, 多ip使用逗号分隔
    secret_id_bound_cidrs="192.168.1.5/32" \

    # 核心限制: 生成的 Token 也只能在 这个 ip 上使用
    token_bound_cidrs="192.168.1.5/32" \
    token_ttl="1h" \
    token_max_ttl="3h" \
    policies="pki-policy"           # 绑定某个策略

vault auth enable userpass      # 开启 userpass 认证
vault auth list                 # 查看已经开启的认证方法
vault list auth/userpass/users  # 查看全部用户

# 新建一个用户, 增加策略也是这个命令
vault write auth/userpass/users/alice \
    password="foo" \
    policies="admin"            # 关联 admin 这个策略

# 登录时会自动获取 token
vault login -method=userpass username=admin

curl --request POST \
    --data '{"password": "user_password"}' \
    ${VAULT_ADDR}/v1/auth/userpass/login/admin


# 设置环境变量
export VAULT_TOKEN="hvs.xxx..."

vault login -method=userpass username=admin
Key                    Value
---                    -----
token                  hvs.CAESIKXoJd6k37JUxGEZZ5tHOdBydB4Y07Zfl0B3z8FrmpY-Gh4KHGh2cy5YT3FLaGNEbEJSeDJPYUdRcTFZN3R4aTg
token_accessor         jfy69OCJVuZXn6gjKfdWbsmg
token_duration         768h
token_renewable        true
token_policies         ["admin" "default"]
identity_policies      []
policies               ["admin" "default"]
token_meta_username    admin

# 查看 Token 详情, 验证权限
vault token lookup

Key                 Value
---                 -----
accessor            jfy69OCJVuZXn6gjKfdWbsmg
creation_time       1775833166
creation_ttl        768h
display_name        userpass-admin
entity_id           bebb8efc-3615-7fff-219d-78598cf87bb3
expire_time         2026-05-12T22:59:26.642334339+08:00
explicit_max_ttl    0s
id                  hvs.CAESIKXoJd6k37JUxGEZZ5tHOdBydB4Y07Zfl0B3z8FrmpY-Gh4KHGh2cy5YT3FLaGNEbEJSeDJPYUdRcTFZN3R4aTg
issue_time          2026-04-10T22:59:26.642342468+08:00
meta                map[username:admin]
num_uses            0
orphan              true
path                auth/userpass/login/admin
policies            [admin default]
renewable           true
ttl                 767h59m35s
type                service


# 用户登录后修改密码
vault write auth/userpass/users/alice/password password="NewSecurePassword"

vault secrets enable aws

# 写入一个高级权限的aws账号
vault write aws/config/root \
    access_key=AKIAZXN6JNH5D6ZSHS5V \
    secret_key=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 \
    region=us-east-1

# 创建一个角色(vpc)，让它可以操作 VPC
vault write aws/roles/vpc \
    credential_type=iam_user \
    policy_document=-<<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    }
  ]
}
EOF

# 获取 access_key 和 secret_key, 这里获取到的是 aws 的;
# Vault 中把动态生成的机密信息关联了一个 lease 租约, 默认 768h 可用
vault read aws/creds/vpc

# 手动吊销租约, 会删除 aws iam 账号
vault lease revoke aws/creds/vpc/w8OTDxIri80TCkGtoZPkc6Qc

# 设置生成的 Key 的有效时间
vault secrets tune -default-lease-ttl=30m aws/

# 开启阿里云认证插件
vault auth enable alicloud

# 配置 Vault 访问阿里云的凭证(建议给这个 RAM 用户最小权限: Action: "sts:GetCallerIdentity")
vault write auth/alicloud/config \
    access_key="YOUR_ACCESS_KEY" \
    secret_key="YOUR_SECRET_KEY"

# 创建 Vault 角色并绑定 RAM 角色
# 这一步是建立 RAM 角色 (ARN) 与 Vault 策略 之间的映射关系

# 创建一个 Vault 角色, 绑定到特定的阿里云 RAM 角色 ARN
vault write auth/alicloud/role/homelab-gpu-node \
    arn="acs:ram::1234567890:role/my-gpu-instance-role" \
    policies="pki-policy,kv-readonly" \
    ttl="1h"

# 只有拥有 my-gpu-instance-role 这个 RAM 角色的实例, 才能登录这个 Vault 角色

# 启用 v1
vault secrets enable -version=1 kv

vault kv put kv/my-secret my-value=s3cr3t

vault kv get kv/my-secret

vault kv delete kv/my-secret

vault kv list homelab/infra/
vault kv get homelab/infra/aliyun
vault kv list homelab/infra/ssh-keys/


vault kv put secret/test db_password=123456   # 创建秘密
vault kv get secret/test                      # 读取秘密(应显示 db_password:123456)

# 开启 SSH 秘密引擎
vault secrets enable -path=ssh-client-signer ssh

# 配置 Vault 生成自己的 CA 私钥和公钥
# 注意: Vault 会安全地保存私钥, 只把公钥给你
vault write ssh-client-signer/config/ca generate_signing_key=true

需要获取 Vault 的 CA 公钥, 并把它放到你所有服务器 /etc/ssh/trusted-user-ca-keys.pem
并在 sshd_config 里引用它

# 获取公钥并保存
curl -o /etc/ssh/ssh_ca.pub $VAULT_ADDR/v1/ssh-client-signer/public_key

vault write ssh-client-signer/roles/ops-role \
    key_type=ca \
    allow_user_certificates=true \
    allowed_users="ops" \           # 为证书里的角色名
    default_extensions="permit-pty,permit-port-forwarding" \
    allow_user_key_ids=true \
    key_id_format="{{token_display_name}}" \
    max_ttl="1h" \
    ttl="1h"


# key_id_format: 这会自动把登录 Vault 的用户名(如 alice)填入证书的 Key ID (-I)

ssh-keygen -t ed25519 -f ~/.ssh/vault_temp -N ""

# 提交自己的公钥进行签名 - 获取到证书文件
vault write -field=signed_key ssh-client-signer/sign/ops-role \
    public_key=@$HOME/.ssh/vault_temp.pub > ~/.ssh/vault_temp-cert.pub

# 登录目标系统的公共账号 ops-runner, 会自动引用 vault_temp-cert.pub 文件
ssh -i ~/.ssh/vault_temp ops-runner@192.168.5.x

# 配置 PKI 角色, 限制只能申请特定的域名, 有效期 24 小时
vault write pki_int/roles/homelab-node \
    allowed_domains="homelab.local" \
    allow_subdomains=true \
    max_ttl="24h" \
    generate_lease_with_token=true

#!/bin/bash
set -e

# --- 配置区 ---
VAULT_ADDR="https://vault.services.wait"
ROLE_NAME="homelab-node"
COMMON_NAME="ub05.homelab.local"   # 当前机器的域名
CERT_DIR="/etc/ssl/vault"
RESTART_COMMAND="systemctl reload nginx" # 或者 traefik

# AppRole 凭证 (建议通过环境变量或受保护的文件读取)
ROLE_ID="你的 -role-id"
SECRET_ID="你的 -secret-id"

# --- 1. 登录 Vault 获取临时 Token ---
echo "Logging into Vault..."
LOGIN_TOKEN=$(vault write -field=token auth/approle/login \
    role_id="$ROLE_ID" secret_id="$SECRET_ID")

export VAULT_TOKEN=$LOGIN_TOKEN

# --- 2. 申请新证书 ---
echo "Requesting new certificate for $COMMON_NAME..."
CERT_DATA=$(vault write -format=json pki_int/issue/$ROLE_NAME \
    common_name="$COMMON_NAME" ttl="24h")

# --- 3. 解析并保存证书, 私钥和 CA 链 ---
mkdir -p $CERT_DIR
chmod 700 $CERT_DIR

echo "$CERT_DATA" | jq -r '.data.certificate' > $CERT_DIR/cert.pem
echo "$CERT_DATA" | jq -r '.data.private_key' > $CERT_DIR/key.pem
echo "$CERT_DATA" | jq -r '.data.issuing_ca' > $CERT_DIR/ca.pem

# 合并证书链 (很多 Web 服务需要这个)
cat $CERT_DIR/cert.pem $CERT_DIR/ca.pem > $CERT_DIR/fullchain.pem

echo "Certificates updated in $CERT_DIR"

# --- 4. 重载服务 ---
echo "Reloading service..."
$RESTART_COMMAND

echo "Done!"

# 启用审计日志
vault audit enable file file_path=/vault/logs/audit.log  # 登录后执行

创建子 token 和限制策略
vault policy write mysql-readonly readonly-policy.hcl

# 创建带限制的子 Token
# 创建一个有效期 24 小时, 只能用 10 次, 绑定该策略的子 Token
# 得到一个以 hvs. 开头的 Token, 它只能执行策略定义的读取操作
vault token create -policy="mysql-readonly" -ttl="24h" -use-limit=10

vault policy list                   # 列出策略
vault policy read <policy-name>     # read
vault read sys/policy               # 列出所有已注册的策略

# create
vault policy write policy-name policy-file.hcl

# update
vault write my-existing-policy updated-policy.json

vault delete sys/policy/policy-name


# 关联策略

## 创建用户时关联策略
vault write auth/userpass/users/user1 \
    password="s3cr3t!" \
    policies="dev-readonly,logs"

vault login -method="userpass" username="user1"

## 创建令牌时附加策略
vault token create -policy=dev-readonly -policy=logs

# 创建令牌时排除 default 策略
vault token create -no-default-policy

curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data '{"no_default_policy": "true"}' \
  https://vault.hashicorp.rocks/v1/auth/token/create

# 吊销根令牌
vault token revoke "<token>"

curl \
  --request POST \
  --header "X-Vault-Token: ..." \
  --data '{"token": "<token>"}' \
  https://vault.hashicorp.rocks/v1/auth/token/revoke

# 第一步: 启用插, 进入容器执行, 或配置好本地 VAULT_ADDR 后执行
vault secrets enable ethereum

# 第二步: 创建钱包(私钥)

# 让 Vault 生成新钱包, 这会返回一个以太坊地址(如 0xabc...), 但不会返回私钥
vault write ethereum/accounts/my-sepolia-wallet

# 方法 2: 导入现有私钥
vault write ethereum/accounts/import-wallet \
    private_key="你的十六进制私钥"


## 第三步: 请求签名(交易)
# 当你的 Sepolia 节点需要发送一笔交易时, 应用构造好交易 RLP 编码或交易 JSON, 发送给 Vault:
# Vault 会返回一个 signed_transaction, 直接将其广播到以太坊网络即可
```bash
vault write ethereum/accounts/my-sepolia-wallet/sign \
    transaction='{"to":"0x...","value":"1000000000000000000","gas":21000,"gas_price":"20000000000"}'

docker pull hashicorp/vault:1.21

services:
  vault:
    image: hashicorp/vault:1.21
    container_name: vault
    restart: always
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: xxxxxxxxxxxxxewofoeiwoiieo
      VAULT_ADDR: "=http://0.0.0.0:8200"
      TZ: Asia/Shanghai
      LANG: en_US.UTF-8
    cap_add:
      - IPC_LOCK
    ports:
      - 8200:8200/tcp

docker exec -it vault-dev sh vault status  # 输出 Sealed: false 即正常

mkdir -p /opt/vault/{config,data,logs}
chown -R 100:100 /opt/vault/    # Vault 默认用户 ID 是 100

docker run -d --name vault-dev \
  -p 8200:8200 \
  -v /opt/vault/config:/vault/config \
  -v /opt/vault/data:/vault/data \
  --cap-add=IPC_LOCK \
  hashicorp/vault:latest \
  server

volumes:
  vault_volume:
    name: vault_volume

services:
  vault:
    image: hashicorp/vault:1.21
    container_name: vault
    restart: always
    environment:
      VAULT_ADDR: "=http://0.0.0.0:8200"
      TZ: Asia/Shanghai
      LANG: en_US.UTF-8
    cap_add:
      - IPC_LOCK

    networks:
      - core
    ports:
      - 8200:8200/tcp
    volumes:
      - vault_volume:/vault
      - ./vault.hcl:/config/vault.hcl:ro
    command:
      - "server"
      - "-config=/config/vault.hcl"
    labels:
      - "service_name=vault"
    logging:
      options:
        labels: "service_name"

docker exec -it vault-1 vault operator init

vault operator unseal

services:
  vault-1:
    image: hashicorp/vault:latest
    container_name: vault-1
    volumes:
      - ./vault-1/config:/vault/config
      - ./vault-1/data:/vault/data
    cap_add:
      - IPC_LOCK
    command: server
    ports:
      - "8200:8200"
    environment:
      VAULT_ADDR: 'http://127.0.0.1:8200'

  vault-2:
    image: hashicorp/vault:latest
    container_name: vault-2
    volumes:
      - ./vault-2/config:/vault/config
      - ./vault-2/data:/vault/data
    cap_add:
      - IPC_LOCK
    command: server
    ports:
      - "8202:8200"

  vault-3:
    image: hashicorp/vault:latest
    container_name: vault-3
    volumes:
      - ./vault-3/config:/vault/config
      - ./vault-3/data:/vault/data
    cap_add:
      - IPC_LOCK
    command: server
    ports:
      - "8203:8200"