{"id":343184,"date":"2022-12-26T21:00:32","date_gmt":"2022-12-26T21:00:32","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=343184"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2022-12-26T21:00:32","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=343184","title":{"rendered":".NET \u0438 HasiCorp Vault: \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 .NET Core \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n
<\/figcaption><\/figure>\n

\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430<\/h2>\n

\u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043a8s \u043a\u043b\u0430\u0441\u0442\u0435\u0440, \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Mimkube<\/u><\/a> \u0438\u043b\u0438 k3s<\/u><\/a>. \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c helm<\/u><\/a> <\/strong>\u0438 jg<\/u><\/a>.<\/strong><\/p>\n

\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Vault<\/h2>\n

HasiCorp \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c Vault \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 helm chart<\/u><\/a>.<\/p>\n

\u0414\u043e\u0431\u0430\u0432\u0438\u043c \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439.<\/p>\n

$helm repo add hashicorp https:\/\/helm.releases.hashicorp.com \"hashicorp\" has been added to your repositories<\/code><\/pre>\n
\u041e\u0431\u043d\u043e\u0432\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\u00a0<\/p>\n
$helm repo update Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the \"hashicorp\" chart repository Update Complete. \u2388Happy Helming!\u2388<\/code><\/pre>\n
\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0447\u0430\u0440\u0442\u0430, \u043d\u0430\u0448\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u0443\u0434\u0435\u0442 \u0431\u0435\u0437 HA, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441 HA.<\/p>\n
$helm install vault hashicorp\/vault --set='server.ha.enabled=false' NAME: vault LAST DEPLOYED: Sun Dec 18 08:54:20 2022 NAMESPACE: default STATUS: deployed REVISION: 1 NOTES: Thank you for installing HashiCorp Vault!  Now that you have deployed Vault, you should look over the docs on using Vault with Kubernetes available here:  https:\/\/www.vaultproject.io\/docs\/   Your release is named vault. To learn more about the release, try:    $ helm status vault   $ helm get manifest vault<\/code><\/pre>\n
\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c, \u0447\u0442\u043e \u0432\u0441\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u043e\u0441\u044c.<\/p>\n
$kubectl get po NAME                                READY   STATUSRESTARTS   AGE vault-0                             0\/1 Running   0      3m9s vault-agent-injector-77fd4cb69f-4brdw   1\/1 Running   0      3m9s<\/code><\/pre>\n
\u041f\u043e\u0434 vault-0 \u0432 \u0441\u0442\u0430\u0442\u0443\u0441\u0435 Running, \u043d\u043e \u0435\u0449\u0435 \u043d\u0435 \u0433\u043e\u0442\u043e\u0432 \u043a \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0435\u0433\u043e \u0435\u0449\u0435 \u043d\u0435 \u043f\u0440\u043e\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0435\u0433\u043e \u0441\u0442\u0430\u0442\u0443\u0441.<\/p>\n
$kubectl exec vault-0 -- vault status Key            Value ---            ----- Seal Type      shamir Initialized    false Sealed         true Total Shares   0 Threshold      0 Unseal Progress0\/0 Unseal Nonce   n\/a Version        1.12.1 Build Date     2022-10-27T12:32:05Z Storage Type   file HA Enabled     false<\/code><\/pre>\n
\u041c\u044b \u0432\u0438\u0434\u0438\u043c, \u0447\u0442\u043e Vault \u0435\u0449\u0435 \u043d\u0435 \u043f\u0440\u043e\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d \u0438 \u0437\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u043d.\u00a0\u00a0<\/p>\n
\u00a0\u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f Vault<\/h2>\n
\u041f\u0440\u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 Vault \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f\u00a0 \u043d\u0435 \u043f\u0440\u043e\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0438 \u0437\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u043d\u043d\u044b\u043c. 
\u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u043c \u0441 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0432 \u0444\u0430\u0439\u043b.<\/p>\n
$kubectl exec vault-0 -- vault operator init \\ -key-shares=1 -key-threshold=1 -format=json > cluster-keys.json<\/code><\/pre>\n
\u0421\u043e\u0445\u0440\u0430\u043d\u0438\u043c Vault unseal key \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u0441\u0440\u0435\u0434\u044b \u0438 \u0440\u0430\u0441\u043f\u0435\u0447\u0430\u0442\u0430\u0435\u043c.\u00a0<\/p>\n
$VAULT_UNSEAL_KEY=$(cat cluster-keys.json | jq -r \".unseal_keys_b64[]\") $kubectl exec vault-0 -- vault operator unseal $VAULT_UNSEAL_KEY Key         Value ---         ----- Seal Type   shamir Initialized true Sealed      false Total Shares1 Threshold   1 Version     1.12.1 Build Date  2022-10-27T12:32:05Z Storage Typefile Cluster Namevault-cluster-cdeb59eb Cluster ID  67d6948e-529e-98e1-e86b-d83342f0584f HA Enabled  false<\/code><\/pre>\n
Vault \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0438 \u0433\u043e\u0442\u043e\u0432 \u043a \u0440\u0430\u0431\u043e\u0442\u0435.<\/p>\n
\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432<\/h3>\n
\u041d\u0430\u0448\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u0431\u0440\u0430\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432. \u0414\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \u043d\u0443\u0436\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441 root token, \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c key-value secret engine<\/u><\/a>, \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043d\u0430\u0448\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u044b.\u00a0<\/p>\n
\u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043c \u0440\u0443\u0442\u043e\u0432\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u0441\u0440\u0435\u0434\u044b.<\/p>\n
$export VAULT_ROOT_TOKEN=$(cat cluster-keys.json | jq -r \".root_token\")<\/code><\/pre>\n
\u0417\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 Vault \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0434\u0438\u043c \u0442\u0443\u0434\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e.\u00a0<\/p>\n
$kubectl exec --stdin=true --tty=true vault-0 \\ -- \/bin\/sh -c \"env VAULT_ROOT_TOKEN=$(echo $VAULT_ROOT_TOKEN)  \/bin\/sh\"<\/code><\/pre>\n
\u0422\u0435\u043f\u0435\u0440\u044c \u043b\u043e\u0433\u0438\u043d\u0438\u043c\u0441\u044f \u0432 Vault.<\/p>\n
\/ $ vault login $VAULT_ROOT_TOKEN Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run \"vault login\" again. Future Vault requests will automatically use this token.  Key              Value ---              ----- token            <your token here> token_accessor   <your token here> token_duration   \u221e token_renewable  false token_policies   [\"root\"] identity_policies[] policies         [\"root\"]<\/code><\/pre>\n
\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 kv-v2 \u0441 \u043f\u0443\u0442\u0435\u043c secrets.<\/p>\n
 \/ $ vault secrets enable -path=secrets kv-v2 Success! Enabled the kv-v2 secrets engine at: secrets\/<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0435\u043c \u0441\u0435\u043a\u0440\u0435\u0442 \u0434\u043b\u044f \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.<\/p>\n
\/ $ vault kv put secrets\/services\/dotnet username='Bob' password='Bob_Password' ======== Secret Path ======== secrets\/data\/services\/dotnet  ======= Metadata ======= Key            Value ---            ----- created_time   2022-12-18T10:26:35.169923707Z custom_metadata<nil> deletion_time  n\/a destroyed      false version        1<\/code><\/pre>\n
\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0447\u0442\u043e \u0441\u0435\u043a\u0440\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u043e \u043f\u0443\u0442\u0438 secrets\/services\/dotnet.<\/p>\n
\/ $ vault kv get secrets\/services\/dotnet ======== Secret Path ======== secrets\/data\/services\/dotnet  ======= Metadata ======= Key            Value ---            ----- created_time   2022-12-18T10:26:35.169923707Z custom_metadata<nil> deletion_time  n\/a destroyed      false version        1  ====== Data ====== Key     Value ---     ----- passwordBob_Password usernameBob<\/code><\/pre>\n
\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\u00a0 \u0432 Kubernetes<\/h3>\n
\u0420\u0443\u0442\u043e\u0432\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043d\u0430 \u043b\u044e\u0431\u043e\u043c \u043f\u0443\u0442\u0438. \u041d\u0430\u0448\u0435\u043c\u0443 \u0436\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u0435\u043d\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u043f\u0443\u0442\u0438. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0442\u043e\u043a\u0435\u043d \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c.<\/p>\n
\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0447\u0435\u0440\u0435\u0437 Kubernetes.<\/p>\n
\/ $ vault auth enable kubernetes Success! Enabled kubernetes auth method at: kubernetes\/<\/code><\/pre>\n
\u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a API Kubernetes.<\/p>\n
\/ $ vault write auth\/kubernetes\/config \\ kubernetes_host=\"https:\/\/$KUBERNETES_PORT_443_TCP_ADDR:443\" Success! Data written to: auth\/kubernetes\/config<\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0435\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c service, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u043f\u043e \u043f\u0443\u0442\u0438 secrets\/data\/services\/dotnet.<\/p>\n
\/ $ vault policy write service - <<EOF > path \"secrets\/data\/services\/dotnet\" { >   capabilities = [\"read\"] > } > EOF Success! Uploaded policy: service <\/code><\/pre>\n
\u0421\u043e\u0437\u0434\u0430\u0435\u043c \u0440\u043e\u043b\u044c \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Kubernetes \u0441 \u0438\u043c\u0435\u043d\u0435\u043c service.<\/p>\n
\/ $ vault write auth\/kubernetes\/role\/service \\ >     bound_service_account_names=* \\ >     bound_service_account_namespaces=* \\ >     policies=service \\ >     ttl=24h Success! Data written to: auth\/kubernetes\/role\/service<\/code><\/pre>\n
\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f<\/h3>\n
\u0422\u0435\u0441\u0442\u043e\u0432\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u043d\u0430 github<\/u><\/a>.<\/p>\n
$git clone https:\/\/github.com\/nkz-soft\/dotnet-k8s-vault<\/code><\/pre>\n
\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e helm chart.<\/p>\n
$cd dotnet-k8s-vault\/deployment\/k8s\/.helm\/ $helm install dotnet-vault . NAME: dotnet-vault LAST DEPLOYED: Sun Dec 18 11:28:47 2022 NAMESPACE: default STATUS: deployed REVISION: 1 NOTES: 1. Get the application URL by running these commands:   export NODE_PORT=$(kubectl get --namespace default -o jsonpath=\"{.spec.ports[0].nodePort}\" services dotnet-vault)   export NODE_IP=$(kubectl get nodes --namespace default -o jsonpath=\"{.items[0].status.addresses[0].address}\")   echo http:\/\/$NODE_IP:$NODE_PORT <\/code><\/pre>\n
\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u043c, \u0447\u0442\u043e \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u0430.\u00a0<\/p>\n
$export DOTNET_K8S_VAULT_PORT=$(kubectl get svc dotnet-vault -o json | jq -r \".spec.ports[].nodePort\") $curl localhost:$DOTNET_K8S_VAULT_PORT\/config {\"VaultSecrets\":null,\"VaultSecrets:userName\":\"Bob\",\"VaultSecrets:password\":\"Bob_Password\"}<\/code><\/pre>\n
\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442<\/h3>\n
\u0421\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 Program.cs.\u00a0<\/p>\n
var builder = WebApplication.CreateBuilder(args); builder.Services.AddHealthChecks();  builder.Configuration .AddJsonFile(\"appsettings.json\", optional: true, reloadOnChange: true) .AddJsonFile($\"appsettings.{builder.Environment.EnvironmentName}.json\", optional: true, reloadOnChange: true) .AddJsonFile(\"\/vault\/secrets\/appsettings.json\", optional: true, reloadOnChange: true);  var app = builder.Build();  app.MapHealthChecks(\"\/healthz\"); app.MapGet(\"\/config\", (IConfiguration configuration) => Results.Ok     (configuration.GetSection(\"VaultSecrets\")         .AsEnumerable().ToDictionary(k => k.Key, v => v.Value)));  app.Run();<\/code><\/pre>\n
\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u0447\u0438\u0442\u0430\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \/vault\/secrets\/appsettings.json \u0438 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 http:\/\/localhost\/config<\/u><\/a><\/p>\n
\u0421\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 configmap.yaml \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0448\u0430\u0431\u043b\u043e\u043d.<\/p>\n
apiVersion: v1 kind: ConfigMap metadata:   name: {{ include \"dotnet-vault.fullname\" . }}   labels: {{- include \"dotnet-vault.labels\" . | nindent 4 }} data:   appsettings.json: | {   \"Logging\": {     \"LogLevel\": {       \"Default\": \"Information\",       \"Microsoft.AspNetCore\": \"Warning\"     }   },   \"VaultSecrets\": {     {{` {{- with secret \"secrets\/data\/services\/dotnet\" }}       \"userName\": \"{{ .Data.data.username }}\",       \"password\": \"{{ .Data.data.password }}\"     {{- end }} `}}   } }<\/code><\/pre>\n
Deployment \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0430\u043d\u043d\u043e\u0442\u0430\u0446\u0438\u0438:<\/p>\n
  vault.hashicorp.com\/agent-inject: \"true\"   vault.hashicorp.com\/agent-copy-volume-mounts: 'dotnet-vault'   vault.hashicorp.com\/agent-inject-secret-appsettings.json: \"\"   vault.hashicorp.com\/agent-inject-template-file-appsettings.json: '\/vault\/config\/appsettings.json'   vault.hashicorp.com\/role: service<\/code><\/pre>\n
    \n
  1. \n
    \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c sidecar Vault \u0430\u0433\u0435\u043d\u0442\u0430.<\/p>\n<\/li>\n
  2. \n
    \u00a0\u041a\u043e\u043f\u0438\u0440\u0443\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0442\u043e\u043c\u0430.<\/p>\n<\/li>\n
  3. \n
    \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0438 \u0448\u0430\u0431\u043b\u043e\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u044b.\u00a0<\/p>\n<\/li>\n
  4. \n
    \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0443\u044e \u0440\u043e\u043b\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430.<\/p>\n<\/li>\n<\/ol>\n
    \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0432 \u043f\u043e\u0434\u0435 \u0430\u0433\u0435\u043d\u0442\u0430 \u0431\u0443\u0434\u0435\u0442 \u043b\u0435\u0436\u0430\u0442\u044c \u0448\u0430\u0431\u043b\u043e\u043d.<\/p>\n
    \/ $ cat vault\/config\/appsettings.json {   \"Logging\": { \"LogLevel\": {   \"Default\": \"Information\",   \"Microsoft.AspNetCore\": \"Warning\" }   },   \"VaultSecrets\": {  {{- with secret \"secrets\/data\/services\/dotnet\" }}   \"userName\": \"{{ .Data.data.username }}\",   \"password\": \"{{ .Data.data.password }}\" {{- end }}   } }<\/code><\/pre>\n
    \u0410 \u0443\u0436\u0435 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435 \u043f\u043e\u0434\u0430 \u0430\u0433\u0435\u043d\u0442\u0430.<\/p>\n
    \/ $ cat \/vault\/secrets\/appsettings.json {   \"Logging\": { \"LogLevel\": {   \"Default\": \"Information\",   \"Microsoft.AspNetCore\": \"Warning\" }   },   \"VaultSecrets\": {   \"userName\": \"Bob\",   \"password\": \"Bob_Password\"   } }<\/code><\/pre>\n<\/p>\n<\/div>\n<\/div>\n<\/div>\n
      <\/div>\n
      
     \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438      https:\/\/habr.com\/ru\/post\/707802\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    <\/div>\n
    \n
    \n
    \n
    \n
    <\/figcaption><\/figure>\n
    \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430<\/h2>\n
    \u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043a8s \u043a\u043b\u0430\u0441\u0442\u0435\u0440, \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Mimkube<\/u><\/a> \u0438\u043b\u0438 k3s<\/u><\/a>. \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c helm<\/u><\/a> <\/strong>\u0438 jg<\/u><\/a>.<\/strong><\/p>\n
    \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Vault<\/h2>\n
    HasiCorp \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c Vault \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 helm chart<\/u><\/a>.<\/p>\n
    \u0414\u043e\u0431\u0430\u0432\u0438\u043c \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439.<\/p>\n
    $helm repo add hashicorp https:\/\/helm.releases.hashicorp.com \"hashicorp\" has been added to your repositories<\/code><\/pre>\n
    \u041e\u0431\u043d\u043e\u0432\u0438\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\u00a0<\/p>\n
    $helm repo update Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the \"hashicorp\" chart repository Update Complete. \u2388Happy Helming!\u2388<\/code><\/pre>\n
    \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0447\u0430\u0440\u0442\u0430, \u043d\u0430\u0448\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u0443\u0434\u0435\u0442 \u0431\u0435\u0437 HA, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441 HA.<\/p>\n
    $helm install vault hashicorp\/vault --set='server.ha.enabled=false' NAME: vault LAST DEPLOYED: Sun Dec 18 08:54:20 2022 NAMESPACE: default STATUS: deployed REVISION: 1 NOTES: Thank you for installing HashiCorp Vault!  Now that you have deployed Vault, you should look over the docs on using Vault with Kubernetes available here:  https:\/\/www.vaultproject.io\/docs\/   Your release is named vault. To learn more about the release, try:    $ helm status vault   $ helm get manifest vault<\/code><\/pre>\n
    \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c, \u0447\u0442\u043e \u0432\u0441\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u043e\u0441\u044c.<\/p>\n
    $kubectl get po NAME                                READY   STATUSRESTARTS   AGE vault-0                             0\/1 Running   0      3m9s vault-agent-injector-77fd4cb69f-4brdw   1\/1 Running   0      3m9s<\/code><\/pre>\n
    \u041f\u043e\u0434 vault-0 \u0432 \u0441\u0442\u0430\u0442\u0443\u0441\u0435 Running, \u043d\u043e \u0435\u0449\u0435 \u043d\u0435 \u0433\u043e\u0442\u043e\u0432 \u043a \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0435\u0433\u043e \u0435\u0449\u0435 \u043d\u0435 \u043f\u0440\u043e\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0435\u0433\u043e \u0441\u0442\u0430\u0442\u0443\u0441.<\/p>\n
    $kubectl exec vault-0 -- vault status Key            Value ---            ----- Seal Type      shamir Initialized    false Sealed         true Total Shares   0 Threshold      0 Unseal Progress0\/0 Unseal Nonce   n\/a Version        1.12.1 Build Date     2022-10-27T12:32:05Z Storage Type   file HA Enabled     false<\/code><\/pre>\n
    \u041c\u044b \u0432\u0438\u0434\u0438\u043c, \u0447\u0442\u043e Vault \u0435\u0449\u0435 \u043d\u0435 \u043f\u0440\u043e\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d \u0438 \u0437\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u043d.\u00a0\u00a0<\/p>\n
    \u00a0\u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f Vault<\/h2>\n
    \u041f\u0440\u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 Vault \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f\u00a0 \u043d\u0435 \u043f\u0440\u043e\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0438 \u0437\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u043d\u043d\u044b\u043c. 
    \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u043c \u0441 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0432 \u0444\u0430\u0439\u043b.<\/p>\n
    $kubectl exec vault-0 -- vault operator init \\ -key-shares=1 -key-threshold=1 -format=json > cluster-keys.json<\/code><\/pre>\n
    \u0421\u043e\u0445\u0440\u0430\u043d\u0438\u043c Vault unseal key \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u0441\u0440\u0435\u0434\u044b \u0438 \u0440\u0430\u0441\u043f\u0435\u0447\u0430\u0442\u0430\u0435\u043c.\u00a0<\/p>\n
    $VAULT_UNSEAL_KEY=$(cat cluster-keys.json | jq -r \".unseal_keys_b64[]\") $kubectl exec vault-0 -- vault operator unseal $VAULT_UNSEAL_KEY Key         Value ---         ----- Seal Type   shamir Initialized true Sealed      false Total Shares1 Threshold   1 Version     1.12.1 Build Date  2022-10-27T12:32:05Z Storage Typefile Cluster Namevault-cluster-cdeb59eb Cluster ID  67d6948e-529e-98e1-e86b-d83342f0584f HA Enabled  false<\/code><\/pre>\n
    Vault \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0438 \u0433\u043e\u0442\u043e\u0432 \u043a \u0440\u0430\u0431\u043e\u0442\u0435.<\/p>\n
    \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432<\/h3>\n
    \u041d\u0430\u0448\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u0431\u0440\u0430\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432. \u0414\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \u043d\u0443\u0436\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441 root token, \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c key-value secret engine<\/u><\/a>, \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043d\u0430\u0448\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u044b.\u00a0<\/p>\n
    \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043c \u0440\u0443\u0442\u043e\u0432\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u0441\u0440\u0435\u0434\u044b.<\/p>\n
    $export VAULT_ROOT_TOKEN=$(cat cluster-keys.json | jq -r \".root_token\")<\/code><\/pre>\n
    \u0417\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 Vault \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0434\u0438\u043c \u0442\u0443\u0434\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e.\u00a0<\/p>\n
    $kubectl exec --stdin=true --tty=true vault-0 \\ -- \/bin\/sh -c \"env VAULT_ROOT_TOKEN=$(echo $VAULT_ROOT_TOKEN)  \/bin\/sh\"<\/code><\/pre>\n
    \u0422\u0435\u043f\u0435\u0440\u044c \u043b\u043e\u0433\u0438\u043d\u0438\u043c\u0441\u044f \u0432 Vault.<\/p>\n
    \/ $ vault login $VAULT_ROOT_TOKEN Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run \"vault login\" again. Future Vault requests will automatically use this token.  Key              Value ---              ----- token            <your token here> token_accessor   <your token here> token_duration   \u221e token_renewable  false token_policies   [\"root\"] identity_policies[] policies         [\"root\"]<\/code><\/pre>\n
    \u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 kv-v2 \u0441 \u043f\u0443\u0442\u0435\u043c secrets.<\/p>\n
     \/ $ vault secrets enable -path=secrets kv-v2 Success! Enabled the kv-v2 secrets engine at: secrets\/<\/code><\/pre>\n
    \u0421\u043e\u0437\u0434\u0430\u0435\u043c \u0441\u0435\u043a\u0440\u0435\u0442 \u0434\u043b\u044f \u043d\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.<\/p>\n
    \/ $ vault kv put secrets\/services\/dotnet username='Bob' password='Bob_Password' ======== Secret Path ======== secrets\/data\/services\/dotnet  ======= Metadata ======= Key            Value ---            ----- created_time   2022-12-18T10:26:35.169923707Z custom_metadata<nil> deletion_time  n\/a destroyed      false version        1<\/code><\/pre>\n
    \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0447\u0442\u043e \u0441\u0435\u043a\u0440\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u043e \u043f\u0443\u0442\u0438 secrets\/services\/dotnet.<\/p>\n
    \/ $ vault kv get secrets\/services\/dotnet ======== Secret Path ======== secrets\/data\/services\/dotnet  ======= Metadata ======= Key            Value ---            ----- created_time   2022-12-18T10:26:35.169923707Z custom_metadata<nil> deletion_time  n\/a destroyed      false version        1  ====== Data ====== Key     Value ---     ----- passwordBob_Password usernameBob<\/code><\/pre>\n
    \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\u00a0 \u0432 Kubernetes<\/h3>\n
    \u0420\u0443\u0442\u043e\u0432\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043d\u0430 \u043b\u044e\u0431\u043e\u043c \u043f\u0443\u0442\u0438. \u041d\u0430\u0448\u0435\u043c\u0443 \u0436\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u0435\u043d\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u043f\u0443\u0442\u0438. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0442\u043e\u043a\u0435\u043d \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c.<\/p>\n
    \u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0447\u0435\u0440\u0435\u0437 Kubernetes.<\/p>\n
    \/ $ vault auth enable kubernetes Success! Enabled kubernetes auth method at: kubernetes\/<\/code><\/pre>\n
    \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a API Kubernetes.<\/p>\n
    \/ $ vault write auth\/kubernetes\/config \\ kubernetes_host=\"https:\/\/$KUBERNETES_PORT_443_TCP_ADDR:443\" Success! Data written to: auth\/kubernetes\/config<\/code><\/pre>\n
    \u0421\u043e\u0437\u0434\u0430\u0435\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c service, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u043f\u043e \u043f\u0443\u0442\u0438 secrets\/data\/services\/dotnet.<\/p>\n
    \/ $ vault policy write service - <<EOF > path \"secrets\/data\/services\/dotnet\" { >   capabilities = [\"read\"] > } > EOF Success! Uploaded policy: service <\/code><\/pre>\n
    \u0421\u043e\u0437\u0434\u0430\u0435\u043c \u0440\u043e\u043b\u044c \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Kubernetes \u0441 \u0438\u043c\u0435\u043d\u0435\u043c service.<\/p>\n
    \/ $ vault write auth\/kubernetes\/role\/service \\ >     bound_service_account_names=* \\ >     bound_service_account_namespaces=* \\ >     policies=service \\ >     ttl=24h Success! Data written to: auth\/kubernetes\/role\/service<\/code><\/pre>\n
    \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f<\/h3>\n
    \u0422\u0435\u0441\u0442\u043e\u0432\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u043d\u0430 github<\/u><\/a>.<\/p>\n
    $git clone https:\/\/github.com\/nkz-soft\/dotnet-k8s-vault<\/code><\/pre>\n
    \u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e helm chart.<\/p>\n
    $cd dotnet-k8s-vault\/deployment\/k8s\/.helm\/ $helm install dotnet-vault . NAME: dotnet-vault LAST DEPLOYED: Sun Dec 18 11:28:47 2022 NAMESPACE: default STATUS: deployed REVISION: 1 NOTES: 1. Get the application URL by running these commands:   export NODE_PORT=$(kubectl get --namespace default -o jsonpath=\"{.spec.ports[0].nodePort}\" services dotnet-vault)   export NODE_IP=$(kubectl get nodes --namespace default -o jsonpath=\"{.items[0].status.addresses[0].address}\")   echo http:\/\/$NODE_IP:$NODE_PORT <\/code><\/pre>\n
    \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u043c, \u0447\u0442\u043e \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u0430.\u00a0<\/p>\n
    $export DOTNET_K8S_VAULT_PORT=$(kubectl get svc dotnet-vault -o json | jq -r \".spec.ports[].nodePort\") $curl localhost:$DOTNET_K8S_VAULT_PORT\/config {\"VaultSecrets\":null,\"VaultSecrets:userName\":\"Bob\",\"VaultSecrets:password\":\"Bob_Password\"}<\/code><\/pre>\n
    \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442<\/h3>\n
    \u0421\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 Program.cs.\u00a0<\/p>\n
    var builder = WebApplication.CreateBuilder(args); builder.Services.AddHealthChecks();  builder.Configuration .AddJsonFile(\"appsettings.json\", optional: true, reloadOnChange: true) .AddJsonFile($\"appsettings.{builder.Environment.EnvironmentName}.json\", optional: true, reloadOnChange: true) .AddJsonFile(\"\/vault\/secrets\/appsettings.json\", optional: true, reloadOnChange: true);  var app = builder.Build();  app.MapHealthChecks(\"\/healthz\"); app.MapGet(\"\/config\", (IConfiguration configuration) => Results.Ok     (configuration.GetSection(\"VaultSecrets\")         .AsEnumerable().ToDictionary(k => k.Key, v => v.Value)));  app.Run();<\/code><\/pre>\n
    \u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u0447\u0438\u0442\u0430\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u0437 \u0444\u0430\u0439\u043b\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \/vault\/secrets\/appsettings.json \u0438 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 http:\/\/localhost\/config<\/u><\/a><\/p>\n
    \u0421\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 configmap.yaml \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0448\u0430\u0431\u043b\u043e\u043d.<\/p>\n
    apiVersion: v1 kind: ConfigMap metadata:   name: {{ include \"dotnet-vault.fullname\" . }}   labels: {{- include \"dotnet-vault.labels\" . | nindent 4 }} data:   appsettings.json: | {   \"Logging\": {     \"LogLevel\": {       \"Default\": \"Information\",       \"Microsoft.AspNetCore\": \"Warning\"     }   },   \"VaultSecrets\": {     {{` {{- with secret \"secrets\/data\/services\/dotnet\" }}       \"userName\": \"{{ .Data.data.username }}\",       \"password\": \"{{ .Data.data.password }}\"     {{- end }} `}}   } }<\/code><\/pre>\n
    Deployment \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0430\u043d\u043d\u043e\u0442\u0430\u0446\u0438\u0438:<\/p>\n
      vault.hashicorp.com\/agent-inject: \"true\"   vault.hashicorp.com\/agent-copy-volume-mounts: 'dotnet-vault'   vault.hashicorp.com\/agent-inject-secret-appsettings.json: \"\"   vault.hashicorp.com\/agent-inject-template-file-appsettings.json: '\/vault\/config\/appsettings.json'   vault.hashicorp.com\/role: service<\/code><\/pre>\n
      \n
    1. \n
      \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c sidecar Vault \u0430\u0433\u0435\u043d\u0442\u0430.<\/p>\n<\/li>\n
    2. \n
      \u00a0\u041a\u043e\u043f\u0438\u0440\u0443\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0442\u043e\u043c\u0430.<\/p>\n<\/li>\n
    3. \n
      \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0438 \u0448\u0430\u0431\u043b\u043e\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u044b.\u00a0<\/p>\n<\/li>\n
    4. \n
      \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0443\u044e \u0440\u043e\u043b\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430.<\/p>\n<\/li>\n<\/ol>\n
      \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0432 \u043f\u043e\u0434\u0435 \u0430\u0433\u0435\u043d\u0442\u0430 \u0431\u0443\u0434\u0435\u0442 \u043b\u0435\u0436\u0430\u0442\u044c \u0448\u0430\u0431\u043b\u043e\u043d.<\/p>\n
      \/ $ cat vault\/config\/appsettings.json {   \"Logging\": { \"LogLevel\": {   \"Default\": \"Information\",   \"Microsoft.AspNetCore\": \"Warning\" }   },   \"VaultSecrets\": {  {{- with secret \"secrets\/data\/services\/dotnet\" }}   \"userName\": \"{{ .Data.data.username }}\",   \"password\": \"{{ .Data.data.password }}\" {{- end }}   } }<\/code><\/pre>\n
      \u0410 \u0443\u0436\u0435 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435 \u043f\u043e\u0434\u0430 \u0430\u0433\u0435\u043d\u0442\u0430.<\/p>\n
      \/ $ cat \/vault\/secrets\/appsettings.json {   \"Logging\": { \"LogLevel\": {   \"Default\": \"Information\",   \"Microsoft.AspNetCore\": \"Warning\" }   },   \"VaultSecrets\": {   \"userName\": \"Bob\",   \"password\": \"Bob_Password\"   } }<\/code><\/pre>\n<\/p>\n<\/div>\n<\/div>\n<\/div>\n
        <\/div>\n
        
       \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438        https:\/\/habr.com\/ru\/post\/707802\/<\/a>
      <\/br><\/br><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-343184","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/343184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=343184"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/343184\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=343184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=343184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=343184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}