OpenBao

OpenBao是Vault的open-source fork。

安裝

curl -s https://openbao.org/assets/openbao-gpg-pub-20240618.asc | gpg --dearmor | sudo tee /usr/share/keyrings/openbao.gpg > /dev/null; echo "deb [signed-by=/usr/share/keyrings/openbao.gpg] https://pkgs.openbao.org/deb/ stable main" | sudo tee /etc/apt/sources.list.d/openbao.list; sudo apt update; sudo install -y openbao; sudo apt clean

設定

這邊的/etc/openbao/openbao.hcl是單機用，全部都在本地：

#
storage "file" {
  path = "/opt/openbao/data"
}

listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = 1
}

seal "static" {
  current_key_id = "static"
  current_key = "file:///opt/openbao/secrets/unseal.key"
}

api_addr = "http://127.0.0.1:8200"
ui = true
log_level = "Info"

然後設定unseal key以及開機啟動：

umask 077; sudo openssl rand -out /opt/openbao/secrets/unseal.key 32; sudo chown -R openbao:openbao /opt/openbao/secrets; sudo systemctl enable --now openbao

第一次需要產生root token，要記錄下來：

BAO_ADDR=http://127.0.0.1:8200/ bao operator init -recovery-shares=1 -recovery-threshold=1

操作

bao secrets enable -path=secret kv-v2
bao kv put secret/myapp/foo key1="ooo" key2="xxx"
echo 'path "secret/data/myapp" { capabilities = ["read"] }' | bao policy write myapp-policy -
bao auth enable approle
bao write auth/approle/role/myapp-role token_policies="myapp-policy"
bao read auth/approle/role/myapp-role/role-id
bao write -f auth/approle/role/myapp-role/secret-id
bao write auth/approle/login role_id="<ROLE_ID>" secret_id="<SECRET_ID>"

外部連結

官方網站（英文）

安裝

設定

操作

相關連結

外部連結