Golang基于Vault实现敏感信息保护

# 首先启用数据库密码引擎
$ vault secrets enable database
# 创建 MySQL 数据库配置
$ export MYSQL_URL=x.x.x.x:3306
$ vault write database/config/mydb \
    plugin_name=mysql-database-plugin \
    connection_url="{{username}}:{{password}}@tcp($MYSQL_URL)/" \
    allowed_roles="mydb-crud" \
    username="root" \
    password="******"
# 说明：该用户需要具有用户管理权限，此处直接使用 root
# 创建 mydb-crud 角色（具有增删改查完整权限）
$ vault write database/roles/mydb-crud \
    db_name=mydb \
    creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT, INSERT, DELETE, UPDATE ON mydb.* TO '{{name}}'@'%';" \
    default_ttl="2m" \
    max_ttl="10m"
# 说明：为方便测试，此处 TTL 设置较小，实际使用时需要评估合理的值
# 测试获取 mydb-crud 角色的凭据，并查看验证
$ vault read database/creds/mydb-crud
$ vault list sys/leases/lookup/database/creds/mydb-crud

# 启用 Approle 认证引擎
$ vault auth enable approle
# 创建权限策略 mydb-policy
$ vault policy write mydb-policy -<<EOF
#获取凭据的权限
path "database/creds/mydb-crud" {
  capabilities = [ "read" ]
}
#续租凭据的权限
path "sys/leases/+/database/creds/mydb-crud/*" {
  capabilities = [ "update" ]
}
EOF
# 创建具有 mydb-policy 权限的 AppRole
$ vault write auth/approle/role/myapp token_policies="mydb-policy" \
    token_ttl=2m token_max_ttl=10m
# 查看创建的 AppRole
$ vault read auth/approle/role/myapp

# 获取 RoleID
$ vault read -field=role_id auth/approle/role/myapp/role-id >~/.roleid
# 获取 SecretID
$vault write -f -field=secret_id auth/approle/role/myapp/secret-id >~/.secretid

auto_auth {
  method {
    type   = "approle"
    config = {
      role_id_file_path = "/vault/config/approle/roleid"
      secret_id_file_path = "/vault/config/approle/secretid"
      remove_secret_id_file_after_reading = false
    }
  }
  sink "file" {
      config = {
          path = "/tmp/.vault-token-via-agent"
      }
  }
}

template_config {
  exit_on_retry_failure = true
}
template {
  error_on_missing_key = true
  source = "/vault/config/appconf/config.ctmpl"
  destination = "/vault/config/appconf/config.yaml.tmp"
  exec {
    command = ["dd", "if=/vault/config/appconf/config.yaml.tmp", "of=/vault/config/appconf/config.yaml" ]
    timeout = "5s"
  }
}

# config.ctmpl
database:
  mysql:
    {{- with secret "database/creds/mydb-crud" }}
    username: {{ .Data.username }}
    password: {{ .Data.password }}
    {{- end }}
    address : x.x.x.x:3306
    dbname  : mydb
    options : charset=utf8mb4&parseTime=True&loc=Local

var (
    mysqlUsername string
    mysqlPassword string
    mysqlAddress  string
    mysqlDBname   string
    mysqlOptions  string
)
func initConfig() {
    mysqlUsername = Config.Database.MySQL.Username
    mysqlPassword = Config.Database.MySQL.Password
    mysqlAddress = Config.Database.MySQL.Address
    mysqlDBname = Config.Database.MySQL.DBname
    mysqlOptions = Config.Database.MySQL.Options
}
func connectMySQL() (*gorm.DB, error) {
    msyqlDSN := fmt.Sprintf("%s:%s@tcp(%s)/%s?%s", mysqlUsername,
        mysqlPassword, mysqlAddress, mysqlDBname, mysqlOptions)
    return gorm.Open(mysql.Open(msyqlDSN), &gorm.Config{})
}

var db *gorm.DB
var dbLocker sync.Mutex
func reconnectMySQL() {
    // get new mysql creds
    creds := getNewMySQLCreds()
    if creds.Username == mysqlUsername && creds.Password == mysqlPassword {
        log.Println("MySQL creds not changed, skip mysql reconnection.")
        return
    }
    dbLocker.Lock()
    defer dbLocker.Unlock()
    // re-connect mysql with new creds
    mysqlUsername = creds.Username
    mysqlPassword = creds.Password
    d, err := connectMySQL()
    if err != nil {
        log.Println("MySQL connect failed:", err)
        return
    }
    // setupDatabase(d)
    db = d
}