setup hashicorp vault

test startup

possibly as user

root_token=`uuid`

vault server -dev -dev-root-token-id $root_token

export VAULT_ADDR=http://localhost:8200
vault login

vault status
vault secrets list

create policy and few secrets

http://localhost:8200/ui/vault/dashboard

let’s create two pathes within the default secret engine, for testing

# policy will apply here
devops/fluentbit
    log_http_user / TEST LOGIN
    log_http_passwd / TEST PASSWORD

# policy won't apply here
devops/another
    http_user / SOMETHING IS WRONG

prepare a policy e.g. as follows – note this is V2 hence data/ is in da place

vi fluentbit-secrets.hcl

path "secret/data/devops/fluentbit" {
    capabilities = ["read", "list"]
}

apply

vault policy write fluentbit-secrets fluentbit-secrets.hcl

create a specific token against that given policy

vault token create -policy=fluentbit-secrets -orphan

vault login

and you should be able to read only devops/fluentbit, not devops/another

vault kv get -mount=secret -format=json devops/fluentbit
==> OK

vault kv get -mount=secret -format=json devops/another
==> 403

additional notes

grab token from ui

when you’re playing with an existing and production vault, you can grab your token from the UI

    Tools / API Explorer
    sys/health Execute

and then proceed as such

    export VAULT_ADDR=https://...
    vault login

resources