啟用KV機(jī)密引擎

#啟用多版本
$ vault secrets enable -path=kv kv-v2
或
$ vault kv enable-versioning kv/

注：啟用多版本后，配置policy和接口調(diào)用讀寫時(shí)，path需以【kv/data/】為前綴，否則只有【kv/】

ACL Policy配置

1. default policy

# Allow all app to read RSA public key
path "kv/data/rsa/public/*" {
  capabilities=["read"]
}

2.應(yīng)用私有policy

示例：user應(yīng)用policy

# Allow app to read own RSA private key
path "kv/data/rsa/private/user" {
  capabilities = ["read"]
}

示例：devops應(yīng)用policy (可以讀寫所有應(yīng)用公私鑰）

path "kv/data/rsa/public/*" {
  capabilities = ["create", "update","read","delete","list"]
}
path "kv/data/rsa/private/*" {
  capabilities = ["create", "update","read","delete","list"]
}

vault客戶端調(diào)用

• vault cli 調(diào)用 path無需/data
• java sdk 調(diào)用 path需/data

#1.讀數(shù)據(jù)： version為空或0，讀取默認(rèn)版本 (返回版本號）
VaultResponse response=vaultApiTemplate.read(path,version);

#2.寫數(shù)據(jù)：
Map<String,String> map=new HashMap<>();
map.put("key","123456");
VaultResponse response=vaultApiTemplate.write(path,map);