unkin/puppet-prod
2
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update headings

Browse Source
This commit is contained in:
Ben Vincent 2024-05-25 16:45:58 +10:00
parent 40c4be6f6e
commit a6a03b4d83
1 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
doc/vault/setup.md
View File

@ -1,4 +1,5 @@
# root ca # PKI
## root ca
vault secrets enable -path=pki_root pki vault secrets enable -path=pki_root pki
vault secrets tune -max-lease-ttl=87600h pki_root vault secrets tune -max-lease-ttl=87600h pki_root
@ -15,7 +16,7 @@
issuing_certificates="$VAULT_ADDR/v1/pki_root/ca" \ issuing_certificates="$VAULT_ADDR/v1/pki_root/ca" \
crl_distribution_points="$VAULT_ADDR/v1/pki_root/crl" crl_distribution_points="$VAULT_ADDR/v1/pki_root/crl"
# intermediate ## intermediate
vault secrets enable -path=pki_int pki vault secrets enable -path=pki_int pki
vault secrets tune -max-lease-ttl=43800h pki_int vault secrets tune -max-lease-ttl=43800h pki_int
@ -32,7 +33,7 @@
vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
# create role ## create role
vault write pki_int/roles/servers_default \ vault write pki_int/roles/servers_default \
issuer_ref="$(vault read -field=default pki_int/config/issuers)" \ issuer_ref="$(vault read -field=default pki_int/config/issuers)" \
allow_ip_sans=true \ allow_ip_sans=true \
@ -46,18 +47,20 @@
key_bits=4096 \ key_bits=4096 \
country="Australia" country="Australia"
# test generating a domain cert ## test generating a domain cert
vault write pki_int/issue/servers_default common_name="test.unkin.net" ttl="24h" vault write pki_int/issue/servers_default common_name="test.unkin.net" ttl="24h"
vault write pki_int/issue/servers_default common_name="test.main.unkin.net" ttl="24h" vault write pki_int/issue/servers_default common_name="test.main.unkin.net" ttl="24h"
vault write pki_int/issue/servers_default common_name="*.test.main.unkin.net" ttl="24h" vault write pki_int/issue/servers_default common_name="*.test.main.unkin.net" ttl="24h"
# remove expired certificates ## remove expired certificates
vault write pki_int/tidy tidy_cert_store=true tidy_revoked_certs=true vault write pki_int/tidy tidy_cert_store=true tidy_revoked_certs=true
# enable approles # AUTH
## enable approles
vault auth enable approle vault auth enable approle
# create certmanager policy and token, limit to puppetmaster # CERTMANAGER
## create certmanager policy and token, limit to puppetmaster
cat <<EOF > certmanager.hcl cat <<EOF > certmanager.hcl
path "pki_int/issue/*" { path "pki_int/issue/*" {
capabilities = ["create", "update", "read"] capabilities = ["create", "update", "read"]
@ -79,5 +82,5 @@
token_max_ttl=30s \ token_max_ttl=30s \
token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32" token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32"
# get the certmanager approle id ## get the certmanager approle id
vault read -field=role_id auth/approle/role/certmanager/role-id vault read -field=role_id auth/approle/role/certmanager/role-id