在 GCE 上安装 Hashicorp 保险库答案

【问题标题】：install Hashicorp vault on GCE在 GCE 上安装 Hashicorp 保险库
【发布时间】：2019-09-11 20:29:36
【问题描述】：

我正在尝试在 google 实例 Redhat 7 上安装 vault，每次运行脚本时，我往往会收到一个用于解封 vault 的有线错误，有时解封安装有时不起作用，以下是错误：

安装代码在git中是here

当我尝试通过命令 vault operator init 解封时：

# vault operator init
Error initializing: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/sys/init
Code: 400. Errors:

* Vault is already initialized


   # echo $VAULT_ADDR
http://127.0.0.1:8200

 vault operator  unseal
Unseal Key (will be hidden): 
Error unsealing: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/sys/unseal
Code: 400. Errors:

* 'key' must be specified in request body as JSON, or 'reset' set to true

服务显示为：

 systemctl status vault.service
● vault.service - "HashiCorp Vault - A tool for managing secrets"
   Loaded: loaded (/etc/systemd/system/vault.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2019-08-27 20:28:59 UTC; 17min ago
     Docs: https://www.vaultproject.io/docs/
 Main PID: 851 (vault)
   CGroup: /system.slice/vault.service
           └─851 /usr/bin/vault server -config=/etc/vault/config.hcl

Aug 27 20:29:02 instance-5 vault[851]: ==> Vault server configuration:
Aug 27 20:29:02 instance-5 vault[851]: Api Address: http://127.0.0.1:8200
Aug 27 20:29:02 instance-5 vault[851]: Cgo: disabled
Aug 27 20:29:02 instance-5 vault[851]: Cluster Address: https://127.0.0.1:8201
Aug 27 20:29:02 instance-5 vault[851]: Listener 1: tcp (addr: "0.0.0.0:8200", cluster address: "0.0.0.0:820...led")
Aug 27 20:29:02 instance-5 vault[851]: Log Level: info
Aug 27 20:29:02 instance-5 vault[851]: Mlock: supported: true, enabled: false
Aug 27 20:29:02 instance-5 vault[851]: Storage: gcs (HA available)
Aug 27 20:29:02 instance-5 vault[851]: Version: Vault v1.2.2
Aug 27 20:29:03 instance-5 vault[851]: ==> Vault server started! Log data will stream in below:
Hint: Some lines were ellipsized, use -l to show in full

根据我应该自动解封的代码

【问题讨论】：

标签： google-cloud-platform hashicorp-vault

【解决方案1】：

从问题中指定的命令来看，您似乎没有在unseal command 中指定密钥。要解封保险库，您必须使用 3 个解封密钥向它展示，并为这 3 个密钥中的每一个运行一次命令：

vault operator unseal key1
vault operator unseal key2
vault operator unseal key3

当您第一次initialize vault 时，控制台上会打印出五个解封密钥，请使用这 5 个密钥中的任意 3 个来解封保管库。

【讨论】：