HashiCorp Vault密钥管理实战：动态密钥与自动轮换部署方案

Vault部署与初始化配置

HashiCorp Vault是开源的密钥管理工具，提供动态密钥生成、密钥轮换、访问控制和审计日志能力。在DevOps实践中，Vault解决了应用程序硬编码密钥的安全隐患，通过统一接口管理数据库凭据、API密钥、TLS证书等各类敏感信息。

以开发模式快速验证：

# 开发模式启动（仅用于测试，数据存储在内存中）
vault server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8200

# 生产环境配置文件 /etc/vault.d/vault.hcl
storage "file" {
  path = "/opt/vault/data"
}

# 或使用Consul作为高可用存储
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/vault.crt"
  tls_key_file  = "/opt/vault/tls/vault.key"
}

api_addr = "https://vault.internal:8200"
cluster_addr = "https://vault.internal:8201"
ui = true

# 启动
systemctl start vault
systemctl enable vault

初始化Vault并解封：

# 设置环境变量
export VAULT_ADDR='https://127.0.0.1:8200'

# 初始化（5个密钥分片，需要3个解封）
vault operator init -key-shares=5 -key-threshold=3 > /opt/vault/init-keys.txt

# 解封（需要执行3次，每次输入不同的unseal key）
vault operator unseal 
vault operator unseal 
vault operator unseal 

# 使用root token登录
vault login 

# 验证状态
vault status

静态密钥与动态密钥配置

Vault支持两类密钥：静态密钥由管理员手动写入，适合API Token等不频繁变更的凭据；动态密钥由Vault按需生成，使用完毕后自动回收，适合数据库连接凭据等高频场景。

静态密钥配置：

# 启用KV密钥引擎
vault secrets enable -path=secret kv-v2

# 写入静态密钥
vault kv put secret/applications/payment   db_username=payment_user   db_password='S3cur3P@ss!2026'   stripe_api_key='sk_live_xxxxx'

# 读取密钥
vault kv get secret/applications/payment

# 设置版本历史，保留10个版本
vault write secret/config max_versions=10

# 读取特定版本
vault kv get -version=2 secret/applications/payment

动态数据库密钥配置：

# 启用数据库密钥引擎
vault secrets enable database

# 配置PostgreSQL连接
vault write database/config/payment-pg   plugin_name=postgresql-database-plugin   connection_url="postgresql://{{username}}:{{password}}@pg-host:5432/payment?sslmode=disable"   allowed_roles="payment-role"   username="vault_admin"   password="vault_admin_password"

# 创建角色：生成凭据有效期为1小时，最大4小时
vault write database/roles/payment-role   db_name=payment-pg   creation_statements="CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';     GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "{{name}}";"   default_ttl="1h"   max_ttl="4h"

# 生成动态凭据
vault read database/creds/payment-role
# 输出:
# Key            Value
# lease_id       database/creds/payment-role/abc123
# lease_duration 1h
# username       v-token-payment-role-xyz789
# password       random-generated-password

动态密钥的核心优势在于每个应用实例获取独立的数据库凭据，凭据到期后自动失效。如果某个实例被入侵，只需回收对应的lease即可，不影响其他实例。

自动轮换策略与Lease管理

# 查看所有活跃的lease
vault list sys/leases/lookup/database/creds/payment-role

# 查看特定lease详情
vault lease lookup database/creds/payment-role/abc123

# 续约lease
vault lease renew database/creds/payment-role/abc123

# 提前回收lease（撤销密钥）
vault lease revoke database/creds/payment-role/abc123

# 撤销某个前缀下的所有lease
vault lease revoke -prefix database/creds/payment-role/

对于静态密钥的自动轮换，Vault的transform引擎和PKI引擎提供了内置轮换能力：

# PKI证书引擎：自动轮换TLS证书
vault secrets enable -path=pki pki
vault secrets tune -max-lease-ttl=87600h pki

# 生成根证书
vault write pki/root/generate/internal   common_name="internal.example.com"   ttl=87600h

# 配置URL和CRL
vault write pki/config/urls   issuing_certificates="https://vault.internal:8200/v1/pki/ca"   crl_distribution_points="https://vault.internal:8200/v1/pki/crl"

# 创建角色
vault write pki/roles/payment-service   allowed_domains="internal.example.com"   allow_subdomains=true   max_ttl="72h"

# 签发证书
vault write pki/issue/payment-service   common_name="payment.internal.example.com"   ttl="24h"

应用集成与Kubernetes对接

应用程序通过Vault Agent或直接API调用获取密钥。Vault Agent Sidecar模式是Kubernetes环境中最常见的方式：

# Vault Agent配置文件 vault-agent-config.hcl
pid_file = "/tmp/pidfile"

auto_auth {
  method "kubernetes" {
    mount_path = "auth/kubernetes"
    config = {
      role = "payment-service"
    }
  }

  sink "file" {
    config = {
      path = "/home/vault/.vault-token"
    }
  }
}

template {
  source      = "/etc/vault/templates/db-creds.tmpl"
  destination = "/etc/secrets/db-credentials.env"
}

# 模板文件 db-creds.tmpl
# {{ with secret "database/creds/payment-role" }}
# DB_USERNAME={{ .Data.username }}
# DB_PASSWORD={{ .Data.password }}
# {{ end }}

策略配置控制应用能访问哪些密钥路径：

# 支付服务策略
cat <<EOF | vault policy write payment-service -
path "database/creds/payment-role" {
  capabilities = ["read"]
}

path "secret/data/applications/payment" {
  capabilities = ["read"]
}

path "pki/issue/payment-service" {
  capabilities = ["create", "update"]
}
EOF

# Kubernetes认证方法配置
vault auth enable kubernetes

vault write auth/kubernetes/config   kubernetes_host="https://kubernetes.default.svc:443"

vault write auth/kubernetes/role/payment-service   bound_service_account_names=payment-sa   bound_service_account_namespaces=production   policies=payment-service   ttl=1h

Vault Agent会定期刷新密钥并将最新值写入本地文件，应用程序只需读取本地文件即可获取密钥，无需直接调用Vault API。当lease即将到期时，Agent自动续约；如果续约失败，Agent会获取新的密钥并更新文件。整个轮换过程对应用透明。