2025/12/20 Hashicorp Vaultやっていき

hr.icon

compose.ymlでいく

code:compose.yml

services:

vault:

image: hashicorp/vault:latest

container_name: vault

ports:

- "8200:8200"

volumes:

- ./config:/vault/config

- ./data:/vault/data

cap_add:

- IPC_LOCK

entrypoint: vault server -config=/vault/config/vault.hcl

restart: unless-stopped

こんなもんで

localhost:8200で開封

cliでログイン

code:sh

export VAULT_ADDR="URL"

vault login

WSOFTアカウントで入れるようにする

IdP登録

code:sh

vault auth enable oidc

vault write auth/oidc/role/wsoft \

bound_audiences="クライアントID" \

user_claim="name" \

policies="default" \

oidc_scopes="openid,email,profile,groups" \

groups_claim="groups"\

ttl="1h"

これでgroupプロビジョニングも効くようになる

Atlantisで使えるようにする

code:sh

vault auth enable approle # approle有効

vault write auth/approle/role/atlantis \

token_policies="atlantis-policy" \

token_ttl=1h \

token_max_ttl=4h

# ロールIDをとる

vault read auth/approle/role/atlantis/role-id

# シークレットIDも

vault write -f auth/approle/role/atlantis/secret-id

次にterraform側。providerを作るだけでいい

code:provider.tf

provider "vault" {

}

Atlantisに環境変数渡しタイム

code:.env

VAULT_ADDR=vaultのurl

VAULT_AUTH_PATH=auth/approle/login

VAULT_ROLE_ID=最高のロールID

VAULT_SECRET_ID=最強のシークレット

applyいけるか

おっと?だめじゃん

code:stdout

│ Error: no vault token set on Client

code:.env

VAULT_TOKEN=''

あかんやん

code:tf

provider "vault" {

auth_login{}

}

オフィシャルないうこと聞きましょう

code:tf

variable login_approle_role_id {}

variable login_approle_secret_id {}

provider "vault" {

address = "URL"

auth_login {

path = "auth/approle/login"

parameters = {

role_id = var.login_approle_role_id

secret_id = var.login_approle_secret_id

}

}

}

403

だめじゃん

ポリシーをアタッチする

code:hcl

path "auth/token/create" {

}

path "secret/*" {

}

path "auth/token/lookup-self" {

}

path "auth/token/renew-self" {

}

code:sh

vault policy write atlantis-policy atlantis-policy.hcl

404

やっぱだめじゃん

KVエンジンを有効化してなかった

code:sh

vault secrets enable -path=secret kv-v2

そろそろ手元のマシンでCLIを叩く

code:sh

$ nix-shell -p vault

error:

… while calling the 'derivationStrict' builtin

at «nix-internal»/derivation-internal.nix:37:12:

36|

37| strict = derivationStrict drvAttrs;

| ^

38|

… while evaluating derivation 'shell'

whose name attribute is located at /nix/store/s1gb3k0sa7q6cal9va8z9anvywrb0p6m-source/pkgs/stdenv/generic/make-derivation.nix:541:13

… while evaluating attribute 'buildInputs' of derivation 'shell'

at /nix/store/s1gb3k0sa7q6cal9va8z9anvywrb0p6m-source/pkgs/stdenv/generic/make-derivation.nix:593:13:

592| depsHostHost = elemAt (elemAt dependencies 1) 0;

593| buildInputs = elemAt (elemAt dependencies 1) 1;

| ^

594| depsTargetTarget = elemAt (elemAt dependencies 2) 0;

(stack trace truncated; use '--show-trace' to show the full, detailed trace)

error: Package ‘vault-1.21.1’ in /nix/store/s1gb3k0sa7q6cal9va8z9anvywrb0p6m-source/pkgs/by-name/va/vault/package.nix:76 has an unfree license (‘bsl11’), refusing to evaluate.

a) To temporarily allow unfree packages, you can use an environment variable

for a single invocation of the nix tools.

$ export NIXPKGS_ALLOW_UNFREE=1

{ nixpkgs.config.allowUnfree = true; }

in configuration.nix to override this.

Alternatively you can configure a predicate to allow specific packages:

{ nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [

"vault"

];

}

{ allowUnfree = true; }

to ~/.config/nixpkgs/config.nix.

そうかライセンスがBSLなのね

再チャレ

code:sh

$ export NIXPKGS_ALLOW_UNFREE=1

$ nix-shell -p vault

$ export VAULT_ADDR=url

$ vault login