1
2
3
4
5
6
ip addr add 127.0.0.2/8 dev lo label lo:0
ip addr add 127.0.0.3/8 dev lo label lo:1

cat /etc/hosts
127.0.0.2 vault2.tmp.local
127.0.0.3 vault3.tmp.local

1
openssl req -x509 -sha256 -days 1825 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt -subj "/CN=vaultca.tmp.local/C=RU/ST=Moscow/L=Moscow/O=ZAO tmp/OU=ITDepartment/"

1
2
3
4
openssl req -newkey rsa:2048 -keyout vault.key -out vault.csr -subj "/CN=*.tmp.local/C=RU/ST=Moscow/L=Moscow/O=ZAO tmp/OU=ITDepartment/"
# OR
#openssl genrsa -out vault.key 4096
#openssl req -new -key vault.key -sha256 -out vault.csr -config cert.config

1
2
3
4
5
6
7
8
openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in vault.csr -out vault.crt -days 3650 -CAcreateserial -extfile <(printf "subjectAltName=DNS:*.tmp.local")
# Or for fullname hosts
#openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in vault.csr -out vault.crt -days 3650 -CAcreateserial -extfile <(printf "subjectAltName=DNS.1:vault2.tmp.local,DNS.2:vault3.tmp.local,IP.1:127.0.0.2,IP.2:127.0.0.3")
# OR with file
#openssl x509 -req -sha256 -in vault.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out vault.crt -days 365 -extfile cert.config -extensions 'v3_req'

openssl rsa -in vault.key -out vault_nopass.key
openssl verify -verbose -CAfile rootCA.crt vault.crt

1
cat rootCA.crt >> vault.crt

1
vault server -config=/etc/vault/conf.d/server-2.hcl

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
export VAULT_ADDR='https://vault2.tmp.local:8200'
export VAULT_CACERT=/opt/vault/certs/withca/rootCA.crt
vault status
Key                Value
---                -----
Seal Type          shamir
Initialized        false
Sealed             true
Total Shares       0
Threshold          0
Unseal Progress    0/0
Unseal Nonce       n/a
Version            1.12.0
Build Date         2022-10-10T18:14:33Z
Storage Type       raft
HA Enabled         true

1
2
3
4
5
6
7
8
vault operator init
Unseal Key 1: XPFnXMHpFDqwXK9uCjgtNSw4wlrYkfXRY6QttU1KSsXt
Unseal Key 2: rgTtwxv/Gx84vubOqdvyls9C/IlVWw84E9nplLHe5bhe
Unseal Key 3: 8EyC1p6L701iVs+7c6U4It8P5yk0TWGHV1JJASQHU2z5
Unseal Key 4: /jzdxtVBqPtDQMXls0TcxhoigoA7s4KT/l5VR5vDWNAT
Unseal Key 5: L59iKxsnPHGYc4I83iHeuW0pjujhRN8tm4VJAwXIHFOF

Initial Root Token: hvs.AGXnkD9hJJX2Tf8yzQCp9gNO

1
vault operator unseal # 3раза ибо у нас treshhold 3

1
2
3
4
5
6
7
8
9
vault operator rekey -init -key-threshold=1 -key-shares=1
vault operator rekey
...
#Rekey operation nonce: 939cd1b9-7b23-5bb0-a8e8-2311a1af8937
#Unseal Key (will be hidden):

#Key 1: oQY3TjGmc4OoioVDQG4n2qlgN34MXFdjyumYyezZgIM=

#Operation nonce: 939cd1b9-7b23-5bb0-a8e8-2311a1af8937

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
vault operator unseal
# insert key
vault status
Key                     Value
---                     -----
Seal Type               shamir
Initialized             true
Sealed                  false
Total Shares            1
Threshold               1
Version                 1.12.0
Build Date              2022-10-10T18:14:33Z
Storage Type            raft
Cluster Name            vault-tmp
Cluster ID              78c82cd4-5ce1-0ca6-4849-6e7c5a5822fb
HA Enabled              true
HA Cluster              https://vault2.tmp.local:8201
HA Mode                 active
Active Since            2023-12-21T06:28:31.593633502Z
Raft Committed Index    78
Raft Applied Index      78

1
2
3
4
5
vault login
vault operator raft list-peers
Node          Address                  State     Voter
----          -------                  -----     -----
oadmintst2    vault2.tmp.local:8201    leader    true

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
vault server -config=./server-3.hcl
vault status
Key                Value
---                -----
Seal Type          shamir
Initialized        true
Sealed             true
Total Shares       1
Threshold          1
Unseal Progress    0/1
Unseal Nonce       n/a
Version            1.15.4
Build Date         2023-12-04T17:45:28Z
Storage Type       raft
HA Enabled         true

1
2
3
4
export VAULT_ADDR='https://vault3.tmp.local:8200'
export VAULT_CACERT=/opt/vault/certs/withca/rootCA.crt
vault operator unseal  # USING UNSEAL KEY FROM VAULT2 NODE
# Key from node TWO

1
2
3
4
5
6
7
export VAULT_ADDR='https://vault3.tmp.local:8200'
export VAULT_CACERT=/opt/vault/certs/withca/rootCA.crt
vault operator raft list-peers
Node          Address                  State       Voter
----          -------                  -----       -----
oadmintst2    vault2.tmp.local:8201    follower    true
oadmintst3    vault3.tmp.local:8201    leader      true

1
2
3
4
5
6
7
8
9
10
11
12
export ROOTCA=$(cat rootCA.crt | awk '{printf $0"\\n"}'| sed "s/.\{0,2\}$//; /^$/d") # leader_ca_cert
export VAULTCERT=$(cat vault.crt | awk '{printf $0"\\n"}'| sed "s/.\{0,2\}$//; /^$/d") # leader_client_cert
export VAULTKEY=$(cat vault_nopass.key | awk '{printf $0"\\n"}'| sed "s/.\{0,2\}$//; /^$/d") # leader_client_key

curl \
--request POST \
https://vault3.tmp.local:8200/v1/sys/storage/raft/join -d '{
  "leader_api_addr": "https://vault2.tmp.local:8200",
  "leader_ca_cert": "'"$ROOTCA"'",
  "leader_client_cert": "'"$VAULTCERT"'",
  "leader_client_key": "'"$VAULTKEY"'"
}'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#!/bin/bash

KEY="hH3wcCstmWZ57j7fHJXlPbft5F5HfJgkGgRG8CuOIsg="
URL="https://vault2.tmp.local:8200"

echo "Starting unsealer"
while true
do
    status=$(curl -k -s $URL/v1/sys/seal-status | jq '.sealed')
    if [ true = "$status" ]
    then
        echo "Unsealing"
        curl -k -s --request PUT --data "{\"key\": \"$KEY\"}" $URL/v1/sys/unseal
    fi
    sleep 10
done

1
2
3
4
5
6
7
vault operator raft join "http://vault2.tmp.local:8200" \
        -leader-ca-cert=@rootCA.crt \
        -leader-client-cert=@vault.crt \
        -leader-client-key=@vault_nopass.key
Key       Value
---       -----
Joined    true