28 篇博文 含有标签「深度解析」

# 安装
brew install openbao

# 验证
bao version
# OpenBao v2.5.x ...

# Arch Linux
pacman -Sy openbao

# Fedora / RHEL（需先启用 EPEL）
dnf install -y epel-release
dnf install -y openbao

# Debian / Ubuntu（使用官方仓库）
# 从 https://openbao.org/downloads/ 下载 .deb 包
wget https://github.com/openbao/openbao/releases/download/v2.5.0/bao_2.5.0_linux_amd64.deb
sudo dpkg -i bao_2.5.0_linux_amd64.deb

# 支持三个镜像仓库
docker pull ghcr.io/openbao/openbao:latest
docker pull quay.io/openbao/openbao:latest
docker pull docker.io/openbao/openbao:latest

# 快速启动 Dev 模式
docker run --rm -p 8200:8200 \
  --memory-swappiness=0 \
  --name openbao-dev \
  ghcr.io/openbao/openbao:latest server -dev

# 需要 Go 环境
mkdir -p $GOPATH/src/github.com/openbao && cd $_
git clone https://github.com/openbao/openbao.git
cd openbao
make bootstrap  # 下载依赖
make dev         # 编译 bao 二进制到 ./bin/

# 启动 Dev Server
bao server -dev

# 输出示例：
# ==> OpenBao server configuration:
#              Api Address: http://127.0.0.1:8200
#                      Cgo: disabled
#          Cluster Address: https://127.0.0.1:8201
#               Listener 1: tcp (addr: "127.0.0.1:8200", ...)
#                Log Level: info
#                    Mlock: supported: false, enabled: false
#            Recovery Mode: false
#                  Storage: inmem
#                  Version: OpenBao v2.5.x
#
# WARNING! dev mode is enabled! In this mode, OpenBao runs entirely
# in-memory. Data is lost on restart!
#
# Root Token: hvs.xxxxxxxxxxxxxxxxxxxxxxxx

# 设置环境变量
export BAO_ADDR='http://127.0.0.1:8200'
export BAO_TOKEN='hvs.xxxxxxxxxxxxxxxxxxxxxxxx'  # 使用上面输出的 Root Token

# 验证服务器状态
bao status

# ==========================================
# 写入密钥
# ==========================================
bao kv put secret/myapp/config \
  db_host="postgres.prod.internal" \
  db_port="5432" \
  db_user="app_user" \
  db_password="S3cur3P@ssw0rd!"

# 输出：
# ======= Secret Path =======
# secret/data/myapp/config
#
# ======= Metadata =======
# Key                Value
# ---                -----
# created_time       2026-04-09T11:00:00.000000Z
# custom_metadata    <nil>
# deletion_time      n/a
# destroyed          false
# version            1

# ==========================================
# 读取密钥
# ==========================================
bao kv get secret/myapp/config

# 输出：
# ======= Secret Path =======
# secret/data/myapp/config
#
# ======= Metadata =======
# Key                Value
# ---                -----
# created_time       2026-04-09T11:00:00.000000Z
# version            1
#
# ====== Data ======
# Key             Value
# ---             -----
# db_host         postgres.prod.internal
# db_port         5432
# db_user         app_user
# db_password     S3cur3P@ssw0rd!

# ==========================================
# 读取特定字段
# ==========================================
bao kv get -field=db_password secret/myapp/config
# S3cur3P@ssw0rd!

# ==========================================
# JSON 格式输出（用于脚本/程序）
# ==========================================
bao kv get -format=json secret/myapp/config | jq '.data.data'

# ==========================================
# 更新密钥（创建新版本）
# ==========================================
bao kv put secret/myapp/config \
  db_host="postgres.prod.internal" \
  db_port="5432" \
  db_user="app_user" \
  db_password="N3wS3cur3P@ss!"
# 现在 version = 2

# ==========================================
# 读取历史版本
# ==========================================
bao kv get -version=1 secret/myapp/config

# ==========================================
# 列出所有密钥路径
# ==========================================
bao kv list secret/myapp/

# ==========================================
# 删除密钥（软删除，可恢复）
# ==========================================
bao kv delete secret/myapp/config

# ==========================================
# 恢复已删除的密钥
# ==========================================
bao kv undelete -versions=2 secret/myapp/config

# ==========================================
# 永久销毁指定版本（不可恢复）
# ==========================================
bao kv destroy -versions=1 secret/myapp/config

# 写入密钥 (KV v2)
curl -s \
  --header "X-Vault-Token: $BAO_TOKEN" \
  --request POST \
  --data '{
    "data": {
      "api_key": "sk-abc123def456",
      "api_secret": "super-secret-value"
    }
  }' \
  $BAO_ADDR/v1/secret/data/myapp/api-keys | jq

# 读取密钥
curl -s \
  --header "X-Vault-Token: $BAO_TOKEN" \
  $BAO_ADDR/v1/secret/data/myapp/api-keys | jq '.data.data'

# 查看服务器状态
curl -s $BAO_ADDR/v1/sys/health | jq

# ==========================================
# 1. 启用 Database 引擎
# ==========================================
bao secrets enable database

# ==========================================
# 2. 配置 PostgreSQL 连接
# ==========================================
bao write database/config/my-postgresql-db \
  plugin_name="postgresql-database-plugin" \
  allowed_roles="readonly,readwrite" \
  connection_url="postgresql://{{username}}:{{password}}@postgres.internal:5432/myapp?sslmode=require" \
  username="vault_admin" \
  password="vault_admin_password"

# ==========================================
# 3. 创建只读角色（动态生成的用户只有 SELECT 权限）
# ==========================================
bao write database/roles/readonly \
  db_name="my-postgresql-db" \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
    GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  revocation_statements="DROP ROLE IF EXISTS \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# ==========================================
# 4. 创建读写角色
# ==========================================
bao write database/roles/readwrite \
  db_name="my-postgresql-db" \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  revocation_statements="DROP ROLE IF EXISTS \"{{name}}\";" \
  default_ttl="30m" \
  max_ttl="2h"

# ==========================================
# 5. 动态获取凭证
# ==========================================
bao read database/creds/readonly

# 输出：
# Key                Value
# ---                -----
# lease_id           database/creds/readonly/abcd1234...
# lease_duration     1h
# lease_renewable    true
# password           A1a-xxxxxxxxxxxxxxxxx
# username           v-token-readonly-xxxxxxxxx

# ==========================================
# 6. 续租 Lease
# ==========================================
bao lease renew database/creds/readonly/abcd1234...

# ==========================================
# 7. 手动撤销（立即删除数据库用户）
# ==========================================
bao lease revoke database/creds/readonly/abcd1234...

# ==========================================
# 1. 启用 PKI 引擎（Root CA）
# ==========================================
bao secrets enable pki

# 设置最大 TTL 为 10 年
bao secrets tune -max-lease-ttl=87600h pki

# 生成 Root CA 证书
bao write -field=certificate pki/root/generate/internal \
  common_name="My Organization Root CA" \
  issuer_name="root-2026" \
  ttl=87600h > root_ca.crt

# ==========================================
# 2. 启用中间 CA（Intermediate CA）
# ==========================================
bao secrets enable -path=pki_int pki

bao secrets tune -max-lease-ttl=43800h pki_int

# 生成 CSR
bao write -field=csr pki_int/intermediate/generate/internal \
  common_name="My Organization Intermediate CA" \
  issuer_name="intermediate-2026" > pki_intermediate.csr

# 用 Root CA 签名
bao write -field=certificate pki/root/sign-intermediate \
  csr=@pki_intermediate.csr \
  format=pem_bundle \
  ttl=43800h > intermediate_ca.crt

# 导入签名后的证书
bao write pki_int/intermediate/set-signed \
  certificate=@intermediate_ca.crt

# ==========================================
# 3. 创建角色（定义可签发的证书规范）
# ==========================================
bao write pki_int/roles/internal-service \
  allowed_domains="internal.mycompany.com,svc.cluster.local" \
  allow_subdomains=true \
  max_ttl="720h" \
  key_type="ec" \
  key_bits=256

# ==========================================
# 4. 签发证书
# ==========================================
bao write pki_int/issue/internal-service \
  common_name="api.internal.mycompany.com" \
  ttl="72h"

# 输出包含：
# - certificate    (服务器证书)
# - issuing_ca     (中间 CA 证书)
# - private_key    (私钥，只在此刻返回！)
# - serial_number  (证书序列号)

# 启用 Transit 引擎
bao secrets enable transit

# 创建加密密钥
bao write -f transit/keys/my-app-key

# 加密数据（输入必须 base64 编码）
bao write transit/encrypt/my-app-key \
  plaintext=$(echo -n "my-secret-data" | base64)

# 输出：
# Key            Value
# ---            -----
# ciphertext     vault:v1:xxxxxxxxxxxxxxxxxxxxxx
# key_version    1

# 解密数据
bao write transit/decrypt/my-app-key \
  ciphertext="vault:v1:xxxxxxxxxxxxxxxxxxxxxx"

# 输出中的 plaintext 需要 base64 解码
# echo "base64-output" | base64 -d
# my-secret-data

# 密钥轮换
bao write -f transit/keys/my-app-key/rotate

# 重新加密（使用新密钥版本加密已有密文）
bao write transit/rewrap/my-app-key \
  ciphertext="vault:v1:xxxxxxxxxxxxxxxxxxxxxx"
# ciphertext 变为 vault:v2:...

# ==========================================
# 1. 启用 AppRole
# ==========================================
bao auth enable approle

# ==========================================
# 2. 创建角色
# ==========================================
bao write auth/approle/role/my-app \
  token_policies="my-app-policy" \
  token_ttl=1h \
  token_max_ttl=4h \
  secret_id_ttl=10m \
  secret_id_num_uses=1  # Secret ID 只能使用一次

# ==========================================
# 3. 获取 Role ID（可以嵌入配置文件或环境变量）
# ==========================================
bao read auth/approle/role/my-app/role-id
# role_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

# ==========================================
# 4. 生成 Secret ID（应通过安全通道传递给应用）
# ==========================================
bao write -f auth/approle/role/my-app/secret-id
# secret_id: yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy

# ==========================================
# 5. 应用侧：使用 Role ID + Secret ID 登录
# ==========================================
bao write auth/approle/login \
  role_id="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
  secret_id="yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"

# 输出：
# Key                     Value
# ---                     -----
# token                   hvs.CAESIXXXXXXXXXXXXXXXXXX
# token_accessor          xxxxxxxxxxxxxxxxxxxxxxxx
# token_duration          1h
# token_renewable         true
# token_policies          ["default" "my-app-policy"]

# ==========================================
# 6. 使用获取的 Token 读取密钥
# ==========================================
BAO_TOKEN=hvs.CAESIXXXXXXXXXXXXXXXXXX \
  bao kv get secret/myapp/config

# 启用 Kubernetes Auth
bao auth enable kubernetes

# 配置 Kubernetes 集群信息
bao write auth/kubernetes/config \
  kubernetes_host="https://kubernetes.default.svc:443"

# 创建角色（绑定 Service Account 和 Namespace）
bao write auth/kubernetes/role/my-app \
  bound_service_account_names=my-app-sa \
  bound_service_account_namespaces=production \
  policies=my-app-policy \
  ttl=1h

# 创建/更新策略
bao policy write my-app-policy my-app-policy.hcl

# 查看策略列表
bao policy list

# 查看策略内容
bao policy read my-app-policy

# 删除策略
bao policy delete my-app-policy

# 为已有 Token 关联策略
bao token create -policy="my-app-policy" -ttl=2h

# 初始化（设置 5 个分片，阈值 3）
bao operator init -key-shares=5 -key-threshold=3

# 输出示例：
# Unseal Key 1: abc...
# Unseal Key 2: def...
# Unseal Key 3: ghi...
# Unseal Key 4: jkl...
# Unseal Key 5: mno...
#
# Initial Root Token: hvs.xxxxxxxxxx
#
# 请将这些 Key 分发给不同的人！

# Unseal 过程（需要提供 3 个 Key）
bao operator unseal  # 输入 Key 1
# Sealed: true, Progress: 1/3

bao operator unseal  # 输入 Key 2
# Sealed: true, Progress: 2/3

bao operator unseal  # 输入 Key 3
# Sealed: false  ← Unseal 成功！

# 1. 创建数据目录
sudo mkdir -p /opt/openbao/data
sudo chown openbao:openbao /opt/openbao/data

# 2. TLS 证书准备（假设已有证书）
sudo mkdir -p /etc/openbao/tls
sudo cp server.crt server.key ca.crt /etc/openbao/tls/
sudo chown openbao:openbao /etc/openbao/tls/*
sudo chmod 600 /etc/openbao/tls/server.key

# 3. 启动服务
sudo systemctl enable openbao
sudo systemctl start openbao

# 4. 初始化（仅首次）
export BAO_ADDR='https://openbao.mycompany.com:8200'
export BAO_CACERT='/etc/openbao/tls/ca.crt'

bao operator init \
  -key-shares=5 \
  -key-threshold=3

# ⚠️ 安全保存输出的 Unseal Key 和 Root Token！

# 5. Unseal
bao operator unseal  # 输入 Key 1
bao operator unseal  # 输入 Key 2
bao operator unseal  # 输入 Key 3

# 6. 验证
bao status

# 7. 登录
bao login $ROOT_TOKEN

# 8. 启用审计日志（生产必备）
bao audit enable file file_path=/var/log/openbao/audit.log

# 9. 撤销 Root Token（安全最佳实践）
bao token revoke $ROOT_TOKEN

# 在 Node 2 和 Node 3 上执行
# 首先启动服务
sudo systemctl start openbao

# 然后 Unseal（每个节点都需要独立 Unseal）
bao operator unseal  # Key 1
bao operator unseal  # Key 2
bao operator unseal  # Key 3

# 检查 Raft 成员列表（在 Leader 节点上）
bao operator raft list-peers

# 输出：
# Node       Address            State       Voter
# ----       -------            -----       -----
# node-1     10.0.1.10:8201     leader      true
# node-2     10.0.1.11:8201     follower    true
# node-3     10.0.1.12:8201     follower    true

# 查看 Leader 信息
bao status
# HA Enabled: true
# HA Cluster: https://10.0.1.10:8201
# HA Mode:    active  (或 standby)

# 手动 Step Down（触发领导权转移）
bao operator step-down

# Raft 快照备份
bao operator raft snapshot save backup-$(date +%Y%m%d).snap

# Raft 快照恢复
bao operator raft snapshot restore backup-20260409.snap

# 移除失败的节点
bao operator raft remove-peer node-3

# 文件审计（最常用）
bao audit enable file file_path=/var/log/openbao/audit.log

# Syslog 审计
bao audit enable syslog tag="openbao" facility="AUTH"

# Socket 审计（发送到远程日志系统）
bao audit enable socket address="logserver.internal:9090" socket_type="tcp"

# 查看已启用的审计设备
bao audit list -detailed

# 添加 Helm 仓库
helm repo add openbao https://openbao.github.io/openbao-helm
helm repo update

# 创建 values.yaml
cat <<EOF > openbao-values.yaml
global:
  enabled: true
  tlsDisable: false

server:
  image:
    repository: ghcr.io/openbao/openbao
    tag: "2.5.0"

  # HA 模式（3 副本）
  ha:
    enabled: true
    replicas: 3
    raft:
      enabled: true
      config: |
        ui = true

        listener "tcp" {
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/vault/tls/tls.crt"
          tls_key_file = "/vault/tls/tls.key"
        }

        storage "raft" {
          path = "/vault/data"

          retry_join {
            leader_api_addr = "https://openbao-0.openbao-internal:8200"
            leader_ca_cert_file = "/vault/tls/ca.crt"
          }
          retry_join {
            leader_api_addr = "https://openbao-1.openbao-internal:8200"
            leader_ca_cert_file = "/vault/tls/ca.crt"
          }
          retry_join {
            leader_api_addr = "https://openbao-2.openbao-internal:8200"
            leader_ca_cert_file = "/vault/tls/ca.crt"
          }
        }

        service_registration "kubernetes" {}

  # 持久化存储
  dataStorage:
    enabled: true
    size: 10Gi
    storageClass: "gp3"

  # 资源限制
  resources:
    requests:
      cpu: 500m
      memory: 256Mi
    limits:
      cpu: 2000m
      memory: 1Gi

  # 审计日志存储
  auditStorage:
    enabled: true
    size: 5Gi

# Agent Injector（自动注入 sidecar）
injector:
  enabled: true
  replicas: 2
  resources:
    requests:
      cpu: 100m
      memory: 64Mi

# Web UI
ui:
  enabled: true
  serviceType: ClusterIP
EOF

# 部署
helm install openbao openbao/openbao \
  -n openbao --create-namespace \
  -f openbao-values.yaml

# 启动 Agent
bao agent -config=/etc/openbao/agent.hcl

# ==========================================
# 自动备份脚本
# ==========================================
#!/bin/bash
# /opt/openbao/scripts/backup.sh

BACKUP_DIR="/opt/openbao/backups"
DATE=$(date +%Y%m%d-%H%M%S)
RETENTION_DAYS=30

# 创建快照
bao operator raft snapshot save "${BACKUP_DIR}/openbao-${DATE}.snap"

# 上传到对象存储（示例：AWS S3）
aws s3 cp "${BACKUP_DIR}/openbao-${DATE}.snap" \
  "s3://my-backups/openbao/openbao-${DATE}.snap" \
  --sse aws:kms

# 清理本地旧备份
find "${BACKUP_DIR}" -name "*.snap" -mtime +${RETENTION_DAYS} -delete

echo "[$(date)] Backup completed: openbao-${DATE}.snap"

# 添加到 crontab（每天凌晨 3 点备份）
echo "0 3 * * * /opt/openbao/scripts/backup.sh >> /var/log/openbao/backup.log 2>&1" \
  | crontab -

# 轮换加密密钥（在线操作，不影响服务）
bao operator rotate

# 查看当前密钥信息
bao read sys/key-status
# Key              Value
# ---              -----
# install_time     2026-04-09T00:00:00Z
# term             2  # 密钥已轮换过 1 次