From 4270c65a2605d82e3b200f1837975e772ca4901e Mon Sep 17 00:00:00 2001 From: dannc Date: Tue, 27 Dec 2022 10:15:07 +0700 Subject: [PATCH] homework 14.2: complete all tasks --- readme.md | 1 + .../14.2/config/vault-pod.yml | 17 +++ .../14.2/img/vault_ui_secret.png | Bin 0 -> 16614 bytes .../14-kubernetes-security/14.2/readme.md | 105 ++++++++++++++++++ .../14-kubernetes-security/14.2/vault.py | 17 +++ 5 files changed, 140 insertions(+) create mode 100644 src/homework/14-kubernetes-security/14.2/config/vault-pod.yml create mode 100644 src/homework/14-kubernetes-security/14.2/img/vault_ui_secret.png create mode 100644 src/homework/14-kubernetes-security/14.2/readme.md create mode 100644 src/homework/14-kubernetes-security/14.2/vault.py diff --git a/readme.md b/readme.md index 067f92b..d94d3eb 100644 --- a/readme.md +++ b/readme.md @@ -68,3 +68,4 @@ * [13.4. инструменты для упрощения написания конфигурационных файлов. Helm и Jsonnet](/src/homework/13-kubernetes-config/13.4) * [13.5. поддержка нескольких окружений на примере Qbec](/src/homework/13-kubernetes-config/13.5) * [14.1. Создание и использование секретов](/src/homework/14-kubernetes-security/14.1) +* [14.2 Синхронизация секретов с внешними сервисами. Vault](/src/homework/14-kubernetes-security/14.2) diff --git a/src/homework/14-kubernetes-security/14.2/config/vault-pod.yml b/src/homework/14-kubernetes-security/14.2/config/vault-pod.yml new file mode 100644 index 0000000..baac0b1 --- /dev/null +++ b/src/homework/14-kubernetes-security/14.2/config/vault-pod.yml @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Pod +metadata: + name: 14.2-netology-vault +spec: + containers: + - name: vault + image: vault:1.12.2 + ports: + - containerPort: 8200 + protocol: TCP + env: + - name: VAULT_DEV_ROOT_TOKEN_ID + value: "aiphohTaa0eeHei" + - name: VAULT_DEV_LISTEN_ADDRESS + value: 0.0.0.0:8200 diff --git a/src/homework/14-kubernetes-security/14.2/img/vault_ui_secret.png b/src/homework/14-kubernetes-security/14.2/img/vault_ui_secret.png new file mode 100644 index 0000000000000000000000000000000000000000..33f3df345b389f79e6573cccd95c64f716588ab8 GIT binary patch literal 16614 zcmeIZ2UL^kw>N5Ggc(I}6zL#;>>>fBNR9JHK?emLrAP~71`uf?9a4sI21Z)Of}v-W z5|t7WBtU?mQbqzqh)4+#ObjtVh$)bSwEF_iIsbF-x4wJ7yViHsIct4uv3QdAecos9 zXFt3A_TF!9U+{2K|3>ed4I4J7pFMNxhYcIP+O%QA#%8rGz!jt3qL&*soUA>2>buLy zL7b_SlBonZmnTh%_CIy@j9T`lU%q*CTG;yT=*Z#Ihy9*JMCCt?dhyNPpJ->)RIY6L zYk#`RHt9c1cHB9txx4-w^T)sW{;^Bt;etx;?<*}tZlP>HQ8H+EJZ%5*LZ%2d-8&yT z8yPqFrvJ>eytGgm_o^h^($ArOfIqK(S<)LmK50~BD?WP1%8W$x&PUJM}(?{lB zlE5FoOWw}1dE$se^Qrnde3YH0F_>7Iepq=zepo3bDWg**4pVnM3aCoHbaFw!{nf@E zvFIJ?p>(JNR%edJB>GE2Qd>(yE0s-sp7ZV!x$btRs2*%hDD9Y3#5UL_!Ir}a@E4hR zQN#3c3L(C~=6kmMQMs+WaFo+}#Z3!ee{DIZ0NfCe^R|#LIKlj5)7r=!jP} z{b~M@?7EzMpCDZyM1#2DQ^h_=_E&LXz09zI->V;ZEmaJgL7n_>pc`sC_)NYBt^qx;)!Q$qKcJ@J>bizzjExF^)a8;!yByTxeqB zGqDuB{3#`umD-b2Sc(V3S8C|o>SW~XEGoYaoVMIn;1Khj!Ha9LB>|3ZWaV;F{h~H8 zXDiNcCkq##f1nf*WY&Hop(H`k*DNQ{j!XyXvVuDH4~l#8V`sCf>64`B$Ts2vy&5`L z@|9&w^hF*^MkjwIKxJ(u6D;ZoFfX2+!-3tqG3c!*9WVI&M|3isQ|%L^r(GKN{p2%xg?M@&c2}tZjUc=)R)j#Zxe&z* z@pnTa(0sBok1pfxo{D|*q<;C;CB`q6?pb8g5k^t9PxsPjfT1k}8O4*Nx;TC&N$E}g z?|UrWj19MHn;$O2*mcLB zEN!e71m$LA7zRlVEV-vx^r^{{WP4`C?7|qcaBX(x&9D$hWpQq-BHy;_x9XT|L0z+n zhaGG9gs9J--u9@nn>9G(W~?pHHp@!sW_4M1vlx9TZr!m zpdw zkJyU({hqdg5f?E}r7J%&ydWgETAA#j88K#{4|n_zrg3#hT-rftZ~sZO66!hp`H(Wz zu!%{-r#_~BreOFeFit8MN#1_M7z>65BZ@Z%D(bh;8MFAcN6AbiN4U`o>gj{BWcZCcn7ThHaw)<2an1EzL zgCR%Uh%l9!y!34U_;V<0;|;|L3njX_CO3Y(*kEFjpV5gM#AqGp#~2ou=#!FS>EbCF+?fJSEn~u08JY#NzmNioC-91-bmsMSN4m#6!B8_cl88-c>=lA5f zddgMiIE6lZJewsfI34@(PBxsfM z<*RHx=!^yumIPC(g7dceOik)+@;t#T@lAY#XVh%1%Tme|8dup8ADav!6CJPM} z%}yX-`*bbQTI{2n7mJ!h2Gn^|{-ZrE#MFZb(JL;!$~uBR21Vum<`!kN$rklE~?nj%>yrW07+HV>>Q_io#ld1;JxO|uu zQPc{ybY9lmjIv|*_oyW&4vm7E?el{8OTMuqwY=OT(Z3(5>#!-KiT@cO9++pmikaGR z#C!VN1EBU3gYwx4S9efrYcpzV7H;4Xy~F&dvntUk=Er~wB~3pKUW_G+5Ysy1#TMp) zT$9g*(z4$(7hAz)@IASR@NKaDWzC|YSA&MLRyA4dTGIMSES|GG(DSG~ zFA9b`v)N1U1?5^t$|tHUF$fyKHQ2%4u{!{ow~e&klQlZQ+~%AJ|lY0V$hh zsa}4+te&LVfxJstPf&-=@UxP#%t*DG z`x%{prhBkD(H;>pW4)|-Tf>bcJY_U>#pqZJqNFX^12#X|9XpCg@1{9WG{v>9BBXNI zH&ysi><8WEXys89=gXu0nW?2Di~!!`yU!IV_p(I?ddGVQa<_We9nLGY-B;Hk>lZKY z!}gR|sd&umY(jy|lZNkH0^G`|$E0~v1^hW*pxW92%aL_hA0ZB&e1NQZz!`fnn$LMB zS`NR6XnFW)$>~0%X=;AyMS6#mI&Nhp$7Mb>y4uiIG_mn9mBV@GdOrHV3(-mI*qMolpVJ1a_>{E6 zM9&ZjGEDtFJQ^E{dIGB{WpUohkJa`WN2K^Ee5=W)862UdP5!h;dsAi~=`zT_JvTA+ z{5^^u)^p(mh&yr`cewaMI3+x7cMSK=$Wmi{eeZTClw9Kz^^_F8v$uPZ(c2S!nvi2W z`r>N_UCSXS+bMCvImk;mQF@@unUI4T<&*&5(bMK0v;(E+iP!+%l69S!a3=St5p9g# z1lhe4(sce@^0@m|nL9q02ck|kbAtRD1Bb?3p|$K#hKWtAq5n=VgrkMau12H#>! zZeA}zzWlA8F57ywJBv<^1N|;)W8xT5(l+bq1}=f#C^^vm9QweEro-b}Z17o`#CH`x+d!=w0dI+>_LNhUZR1=LA475-|u zp0d50F&RzGqaI0p2J;aX0Q7CDTUWQoY6-`r_~ zo(6g9`@qa|&SS!g2lZ_`WN|DVe;K@khXe28uDsQzm#V@aiUY)~9y zI_!q1c0-RYj!xqYjJZfbG|vZlWs*#nc+j%@nm|B=84Z>!H3#xuIM~3|V~Cd+^QiUeBc}Z4@gm7?cPm z{$nfw)oweb=o*V6pt}{_BFWcmL2xFzyMsINuz5k8{5qQ2Q!&-k4Q_+u#a)CTqp+hV zPCPg&J7eZBH{;v!$uw5>P_^qwFY5N`Oyga+l38Y0r*Ii>5wH6Skvf~n_X zF2EKmSO=VJyP=*5u+qh`6Yy8R3Z23O7~HU{ypqZuZ3uxH?GHm9GKx#_E2p;%C?~^v zAC)HF_Tkz)J3F(zcx+MI;f~a?jr9wk0F^y9ct|1RyD1@U;Vdx9c0s7kLpvx^fY5~W zmc@)s&`RR!yV z&Ovq)pK84D_oCr@j;UOKMxAq+vC|I7=cdRXL?0o_Uz&emSMNctWvdw{ffQ z!&D|aT(cjCeHk9HEj^7RZxydR&!)G&NLqdpUm8CpTXuB;A-kjNXA1V!)9;P|53n0$ zH_IQI=x$Q|zpviqoW#@CcY)|Bnhfz#cmXAx-NsjYDTArQ{Gn=&%Hf#qz8G9C8KKCA z9}YZ_n=awx3WsNsm?O5fMl_+FoAviGSc)q{=fqx@;HTpk)7gzypKDu|Q~|2B=4jgV z`@?^4KRn-U)1pWebG=PDA!;{whA*3xx^1k&uab-}jQ4BxKse})HT7r~qeE!D+F#m3?A4Mq>G+Z5$&kJ?^# z+g!yzaKoa=H=fyzO|nxFWxLnSCAQc%CG&gr$i1}l&h6Bc^7c@Sw$Cn38?CoBu;~hO z3DqI4qRY`qX<#DEb98`gJXhpoJJKXXXoz}2fU+%B3geW0rW+|zRl|fEtPKS|K~;{& zo{f;VMK04mDh#QjjH_xeN-=GMb8JAb)+Ja^reHh^pYrf@+fs%8ng#441IUw@ZqgTV zr)Dk~sTcHNI@6TjnGd z4h1w=&b95MP!$e+I1CX3>A=p(iQ6<8XgT^>F zQ{=jvG8u6tqZG}8AlFjNG&%zSJHsXxU_j*Dpx+_j8sj1^7mdAJLN$^upg&( zNevtU3HuX(tOXCMWX)#LTT)mE_T$d#jPAHb>j)dyd<=+VU^2e2QeOWux#U)CF~I%s zg?xlf@Jh%YHU}BdDq(ikevdwjK0g}1+^~r%Ns5Fh;p3wu5!UL}-b+{yPGXS#(X;3` zWc~i8WzB+>u>;DMSicns655+LpD1~**p~j9XE*2$Ql1BESRli1*hjfT^c)S0m49qc ze=@fN$*%15fgt^5pBK~gD*+X(eCWJpbDIMt>W$c!4`sxr`aSo;K~?Nenx~F|8aJ}C@qHdB6WKoYJ7p$WDmCh zHp_GgR`@vfii3;dI0S0K&HNbJPtq46xk|KS!IJUiN!7w9l)v*)i zG?J6P-+Grz@Z1zP1;Y5NS@^@4H*rrn*d_RSvr}&hoA-cdu-8zx@GvsvOf~BfNFCn` z{^$~nxEy?U3sJW3<(mt}Yl`{ule;RH%F+KRCCJYEzNv4@IA1?N@xzdYQAvkMw2|y7 zYY8aaE5F(g2E!X@tQjOXQK?$a?|48HQsCh>LhG~zr_xbM+}k-o3Qk1w=D-Ha!%lUu zcLQXQaS~ABk<0jOIX|TjM8&X5RQVebO0@xL>xNvv9PbL;46e9GJ zgb1P_p*|4%5~crMA`GE|(vXLra8j5UZ@MJ;BqGt}mq%`_``BAvc8>RHXGk%j>|+0FOWe3^ z&vRHao6|HbmDo=6^&=Vp2k$pEI%g~KMzv!FepAt@+x?uTy|EgJ64t4w_8GINeO~Yd zNkKl5MiJbH*eHEDjxqk#vW_YWUt0Xsd3t(~92580xEzQ|jr*d8+;4%R<a$IwargSATANbpgGDoU27qw4q>((5T49_sNHN@_>s@2h~9XSK!I*?% zm!);J4F3~(Vs{c?+bP1LqkV<_3#(W(sno6?$K8D4Lsa-Wm1oTEK zSbjA}h|t>vmbQQrALQ*a!{IAkW^Sb9Raf@jN7!6dr1(A5}o^$wm}e+F_Nlx(@#CUHo6)wzzdZV!|12C&MgV!jrq!X&xYPfIKq;iD(%H7(bwyjo}sK~{q1~tUIy5*$+tA&i9RYk(FGI*Y(!8EcCjELszt@CTa*ggn4+X-ecTB9T0E-?FAz`-=6Y8_ zR8%_MP;0kIF1*S<1s`SG|)Rgt0AiITi6=a`-|Cw=mQM))7F zvMTQ~h+%YJOtU0qAftFXy1LCH#keE>GbE`6B8gJ>9{H|nJcTL0wltRJfE$VXLmBuH z>?G0$1X(W znpnt>oyW&dJFzefXpG8ooGTxatp2uAxoW>&!dp zPmsR+H$9)x-^ZY_c>8ZJY^J@}*+jV$75seDms==Vxy|y(O zotKv$cYa8;3jQ}J^rjLcMfY?7K#Q-|8Sh5`@4T>?0xaak&6v{kbvk^b`CsT(r2nP) z_+|8%dis<2y)!o){~a5iT?437&kO(#etykcvzm1*u6`=xq?&%) zcZ_I`q5sCLXV*aWzX9R1rY0`I#-uMh-W$I6C$$BrWak(BpZn{!bojORL)fIWe?{OL zaQbn`-16UP!0HmkmE{|grr_l0|A5VZ(Axko>bfq@y}2LtfY9@39jsRj<(qtg`A@&g z_%h?k7Tv$;=>4Sj1=e5x<9|N!ozAAsKm&b)&d9d()$zjSjFYS5yZgn`o|% z*E==UR!8e#H5Fj^S~8Q{oLU1X&ery^G#;m9u=nYO(^=BRi6aF#Fagp*te?KwB+7$ctuDIGnFO5$$D zCbUc+@3!7<=HcIx7!o@%U5X!>OMGfL|car_Q6| z4XM#%Rz3MHH0x@IX;0|1em2QT^4F~3sT;qvB~`%A9GHTodgAYWbW>?+1;d9%Su?Xs zSPgzhP6jMJqQ6tBuA- zDV+N({WVpafU21}N;7}2M(&E0m+sKVkjYU;b7Lf=ILb*M_;~acJC#{R&<`C}&Gz)A zcn79LLS83BW9`XJXIHk3pjlPvbt})Op5IjK?`_}PjtJt0}ILE8*Ww%yuT0Z-ioBP(6kpjz9 zOjU!3M{U((nQy(};W2iv^4%7_tQ~MN-E_(7I$ps4Ifd{v1ar%(E8lISH)O&;?-%Bs zG_QfdBS_a^XB8VlWd6VF9e7u5JC30pDw}&Ko2+{ZdVSu@twn~HFAMd5qg+G|WORn2 zqY@m#KhLvQS1r3WNBZT`$i+GXUY{U!CHEEkF)=JliPlITFsIHX%H9V9dh~Od?xy2% zNu_RiE^AelU)$2Ne|HX~`KgmO7yih8ZD6##z+TFBv z)@$BJxb1A%n&;T>vgh^t9qut%fkE|Y<+i(>QfLX1(?t{FS6s#$tZf&=)5&(u9d+C( z2oUGb(>j}Uo3=YKS`q5$3A!6e!;G(h%b#*ho~e5}2?7G}%Y){X6u;8ZOU$KDfym5G z*uiR-)q`laRB3uRK4yF0WhO&gse^^2UTTX_-hz%gEr)Ll!Hq-7;~FO4cY#J$P$-(4c)LTg>0L!8?!rzLmZOqu&M(Tvi1 zTK$RjlFg@jd&LB@`QbrY1C@D+3(9IH#*V|(9Dlmr8e=$Gy*(Y?Vw}<0p$ZUrtM4+S zMnT^(lYeYZLeT$;M!%81?ZD+~+e}iL2YVh7aXD!N*R54%^Id`=TsMdjbd|rTA^tr5 z{fKsw9jDLXeQ!R=lbbl6NLV5oXX{=&Lz%a?&C!^770X{?|p1S|H-g zvCm?ptvOmFvOQttgYl=tQq-b!f_^{qsc}cKEKFq<8i*)v&tG&4x5((Usu?)3_-N2{ zL$#Y))t%2rE}iyO_5m_E8M7@t>YB~6`iN%1(OXbFbz_| ze~_1%4JjDKB)i)UqXZWm3TXbWC$ljNQx_S^^&(Wb2q3!)I+{S1N6Lvbr;4T9Ya%rG# zbG%HnZpNBe7+NPyw;>Oizo-}RN9A-RRMfsdfe`ru_Ori8*fYj$R}OP-hQJLs-BV1W z(rnu_aVZp_1RA|3qjQeDSY74~Pr1>6-h#bT=LlB*_74dulM)iT>xG^IAli55xu5fe z*)PX3mLY7A`^kqQCctib-bP@aT8Q`{hRlPDsK@2ST0hcZFGmQ|6p%V zVrFLrASe0N`x=P3&p^ipz9nAGAnM<^35C)wsHY3fjo-|z;`>!Q$+7ozZhuI@DQNI!B(JDxp+sT%;jkI4r4Qkw_5Pm_D0mh)XCdfQIVgM%r~#7}>m z5nXMbI{4G)=P=cb#} z>jx<~Ih(QBMx~1SbbI#eALHF$vudoqcU~6sNMC<&UOnWG+tTGXD5gMfs+GWxYwGx5 zrBY?O#NTn_Pi8swhJ^ulCot*cpyrqc6G)-|Vc}zB?VET$v2lhXi<@yCiyo~m8>L1u-Be~- z*rA(1TSwxaSj;vUKfL*h-f-W=8b>0GXdrp&raS9KW4Z*V=!fq;$EQXnsr7?saS>?8L|2@jzOqeqddYZkVK`B;0B7P0Ni$a|B#OF8aZ7QBp1YZwR zI|umPfBGBF@^^sVxHZY-u=t2&%crB^NoqCInE?u4X&h!{rFr!Ln(mw2*l_<=u;hnn zS!GK|cpC{dR^8{;QGul%CgZlJOA`3yTB`01=|@K+Cl9+lOH{32U5-R1<0uP=rsFCP z7?2l$70YB5IFvrHV6Z#TkUEp_M}*B_{>pJ6b*rtw3h=W->72HbggtpVBw9>ZJQe6V zltK&@20K=*H0M-CC*sUz|Ac@eC^a)wM}*C%z(k*3U$n7P!AG#^v()xbY(738sA(^? zl?7!u>h#4PG2TqkeBj#P4L*Xy@2CR-(lhpx=XA=P?{h^==ljGx6;mb_$^vGTkO^IN z2$6>X-Mx&wc%~XX^T0IVN`jb#YzkIT)2quN!<4A}(L-Dp1dUJCi)5;K!@rJ7czf6l z$8VdvHa58D0TF|WKD!js#$F~9KFperh9@FC%L5P?GGT__gIU!~@DwT$5pe@zYzxrp zd~i(V*qj%tV>Nm_KH{>c{CoS>#fhypN*PgB`3ktWAt6NVr^|03zZ4(aw94I=>csB< zti;7E$LUncDjzxK8J(Y;e>t?;Xk0Hc+ zxz~R&JRP;j&e9sIId{xFJI+~YzeYOzr!cjeV=Ar!AO`NsN9`NFW)2@@K~&dT$GHpJ z(!DY|uQ{nWizefydcF;}df+^&zSbJ97($yo>(kV!&Foayx9Jj)!L(1dL`kmI++i@0 z!fIWwHd(D4Q}Nc_RKBFy9Lwkt%ehF}V_DZ7*Go)R(n^5sdhN>exXznc zsP9F}7{&}w+To^J8o*dKduK~-;O}DAmdw|fniqj7aI1*ztAXfz6eCGM0T7b zyiR|;1Xd0xZoY}dw)A(!UuLJS&3>(Uru|Emtlaj0JOxV1=%hu%Oc06O&9NlWVsrp2 z&jD$q6jb-}vtK?7SwEWG=`|UBQfi7nmwQ^7<7b65PYp12m=#1YR+}f{!fWQZ(>Q0?R8BuR zMZD+fY`6bh!CQ{-thz&vnMX`9L%PUL{OmyzOmmv=WzLao7C2G$5#QOOs)0iA4g&i z1R}g*B|^bhB!NP(5@8$ooREo;!egbQr&6RE;Jb>+x9>UL+}?Iz(>j|3D4?)qRfl#e z^A=@(vHFVT`6#uTyx8#gG*LnPc-{{4_6qSrICt@8>CFNHa$tNauQ`IXG5|o~`TWg4 zrAWbM=Ate+__`Fq65)tID>~1_V#QXa3i8cegvpsBO!C*Txxx(yQ=sJe z2bp%(WmJVb!*59ll)*elaftr-)TPHn?@@=e0aUS(*Vv-m9Obt#ubC|VaE~w*6tq&9 zeoL_R)Vj^kfHpb5*!T#^v1(VFGubQmKz0^x%a*OwWtclnR@PRPO=Kyom?RP41qo84MlhhBsbT!I_s0jW$a zw$5kfmTw?UOQ%IPixEqW!mX!(-)o)A=sfHaER0b*H#~+mPg1V9>4A4z1ags>c1+OCG-XkYjVnPG2D~u8$v+Sbyhh4&PxcSQ!E|o|$pb!)D3FfQ+N_d4 z>1--jx&*fdto&xeem*jM=jU*hb1}-A6GYIKt7>Mw&qMK)$O2L&wOVoW4!^S9X)3xw z(1+PkfNTpz1FxZaR!d)ZTC6$OA7~NF!_%+}?p}~k|1ux>Z-$hrN{HTY?5W@-KJ&uZ z!peyBq7!k1bgMWQHbSAc(*_nHinhjkCO5ut!N%)De$O<9KjHy>AMnm+2472$ZCMUe zGs}E2M+&XRR`y|Nql22haNX#q<9`*<09J-CB0;;9xba>R2&gR%GuUj!Gv@l6PZhO= zYb!%ZnVn@7mNy2XzKYo$gL{TM1w*ZlT2C=g4>3U|ir&~<^zc}ju55D|=*OVfS zblb_5*U8bZSM#RSwa9}dOJwsWR|9Cp9pEh}AVv;kc0%MUydI0Yd3W!+rm^Fk{+}_{ z`AZ)tykadNXRLd%z2Whps~-P<>Fe&r4pw?J@wC@k5I}k6n#45DE!q*1+17i2;+-={u1aA%h=za@wge|k$wH&t1YHi!kUg&P}zXqUx zmQpyay5hJ+Z>qk(#iTclxO@aNeIy(hGn~&X>54?3m_$y zjjYLXp|V^yaVXFxaJ3G-A;Z*V&+7Q!y-9lG-u(ONLu+mOiis(SplYb3Ac q)&Fg~;QxpD{~E6^oN<{^s*XLK_-$YEEyk)sojvVws_vh`zx-d48(N$I literal 0 HcmV?d00001 diff --git a/src/homework/14-kubernetes-security/14.2/readme.md b/src/homework/14-kubernetes-security/14.2/readme.md new file mode 100644 index 0000000..c2bcbd4 --- /dev/null +++ b/src/homework/14-kubernetes-security/14.2/readme.md @@ -0,0 +1,105 @@ +Выполнение [домашнего задания](https://github.com/netology-code/clokub-homeworks/blob/clokub-5/14.2.md) +по теме "14.2 Синхронизация секретов с внешними сервисами. Vault" + +## Q/A + +### Задача 1 + +> Работа с модулем Vault. +> +> Запустить модуль Vault конфигураций через утилиту kubectl в установленном minikube +> +> ``` +> kubectl apply -f config/vault-pod.yml +> ``` + +```text +pod/14.2-netology-vault created +``` + +> Получить значение внутреннего IP пода +> +> ``` +> kubectl get pod 14.2-netology-vault -o json | jq -c '.status.podIPs' +> ``` +> +> Примечание: jq - утилита для работы с JSON в командной строке + +```text +[{"ip":"10.233.102.130"}] +``` + +> Запустить второй модуль для использования в качестве клиента +> +> ``` +> kubectl run -i --tty fedora --image=fedora --restart=Never -- sh +> ``` +> +> Установить дополнительные пакеты +> +> ``` +> dnf -y install pip +> pip install hvac +> ``` + +```shell +pip list +``` + +```text +Package Version +------------------ --------- +certifi 2022.12.7 +charset-normalizer 2.1.1 +gpg 1.17.0 +hvac 1.0.2 +idna 3.4 +libcomps 0.1.18 +pip 22.2.2 +pyhcl 0.4.4 +requests 2.28.1 +rpm 4.18.0 +setuptools 62.6.0 +urllib3 1.26.13 +``` + +> Запустить интерпретатор Python и выполнить следующий код, предварительно +> поменяв IP и токен +> +> ``` +> import hvac +> client = hvac.Client( +> url='http://10.10.133.71:8200', +> token='aiphohTaa0eeHei' +> ) +> client.is_authenticated() +> +> # Пишем секрет +> client.secrets.kv.v2.create_or_update_secret( +> path='hvac', +> secret=dict(netology='Big secret!!!'), +> ) +> +> # Читаем секрет +> client.secrets.kv.v2.read_secret_version( +> path='hvac', +> ) +> ``` + +Предварительно необходимо создать файл `vault.py`, поместить скрипт в него и запустить: + +```shell +python3 vault.py +``` + +Следующим шагом необходимо проверить, что секрет успешно записался в `vault`. Для этого будет выполнено два шага: +* Выполнить `port-forward` до пода `vault`: + + ```shell + kubectl port-forward pods/14.2-netology-vault 8200:8200 + ``` + +* Не выключая консоль зайти в web-версию `vault` по адресу `http://localhost:8200`, авторизоваться + и просмотреть все секреты в хранилище `secrets`: + + ![vault_ui_secret.png](./img/vault_ui_secret.png) diff --git a/src/homework/14-kubernetes-security/14.2/vault.py b/src/homework/14-kubernetes-security/14.2/vault.py new file mode 100644 index 0000000..9087508 --- /dev/null +++ b/src/homework/14-kubernetes-security/14.2/vault.py @@ -0,0 +1,17 @@ +import hvac +client = hvac.Client( + url='http://10.10.133.71:8200', + token='aiphohTaa0eeHei' +) +client.is_authenticated() + +# Пишем секрет +client.secrets.kv.v2.create_or_update_secret( + path='hvac', + secret=dict(netology='Big secret!!!'), +) + +# Читаем секрет +client.secrets.kv.v2.read_secret_version( + path='hvac', +)