Skip to content

Commit 87dba60

Browse files
danisladanisla
committed
Merge remote-tracking branch 'gcp/master'
2 parents d2b31d0 + 1be41a0 commit 87dba60

File tree

5 files changed

+230
-1
lines changed

5 files changed

+230
-1
lines changed

‎README.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ __Table of Contents__
1414
1. [example-k8s-gce](#example-k8s-gce)
1515
1. [example-gke-nat-gateway](#example-gke-nat-gateway)
1616
1. [example-sql-db](#example-sql-db)
17+
1. [example-vault-on-gce](#example-vault-on-gce)
1718

1819
## [example-lb](./example-lb)
1920

@@ -111,4 +112,14 @@ Modules used:
111112

112113
Modules used:
113114

114-
- [terraform-google-sql-db](https://github.com/GoogleCloudPlatform/terraform-google-sql-db)
115+
- [terraform-google-sql-db](https://github.com/GoogleCloudPlatform/terraform-google-sql-db)
116+
117+
## [example-vault-on-gce](./example-vault-on-gce)
118+
119+
**Figure 1.** *example-vault-on-gce diagram*
120+
121+
<img src="./example-vault-on-gce/diagram.png" width="800px"></img>
122+
123+
Modules used:
124+
125+
- [terraform-google-vault](https://github.com/GoogleCloudPlatform/terraform-google-vault)

‎example-vault-on-gce/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
terraform.tfvars
2+
NOTES.md
3+
certs/

‎example-vault-on-gce/README.md

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
# Vault on GCE Example
2+
3+
**Figure 1.** *diagram of Google Cloud resources*
4+
5+
![architecture diagram](./diagram.png)
6+
7+
## Create the Cloud KMS KeyRing for asset encryption:
8+
9+
Cloud KMS is used to encrypt assets like the Vault unseal keys and TLS certificates so they can be securely stored in a Cloud Storage bucket.
10+
11+
Create the key ring and encryption key:
12+
13+
```
14+
gcloud kms keyrings create vault --location global
15+
16+
gcloud kms keys create vault-init --location global --keyring vault --purpose encryption
17+
```
18+
19+
## Set up the environment
20+
21+
Enable the following Google Cloud APIs before continuing:
22+
23+
- Google Compute Engine API
24+
- Google Cloud Storage
25+
- Google Cloud Key Management Service (KMS) API
26+
- Google Identity and Access Management (IAM) API
27+
28+
```
29+
gcloud auth application-default login
30+
export GOOGLE_PROJECT=$(gcloud config get-value project)
31+
```
32+
33+
Add the project ID, bucket name and KeyRing name to the `terraform.tfvars` file:
34+
35+
```
36+
export GOOGLE_PROJECT=$(gcloud config get-value project)
37+
cat - > terraform.tfvars <<EOF
38+
project_id = "${GOOGLE_PROJECT}"
39+
storage_bucket = "${GOOGLE_PROJECT}-vault"
40+
kms_keyring_name = "vault"
41+
EOF
42+
```
43+
44+
## Deploy Vault
45+
46+
```
47+
terraform init
48+
terraform plan
49+
terraform apply
50+
```
51+
52+
After a few minutes, the Vault instance will be ready.
53+
54+
## SSH Into Vault Instnace
55+
56+
Use SSH to connect to the Vault instance:
57+
58+
```
59+
gcloud compute ssh $(gcloud compute instances list --limit=1 --filter=name~vault- --uri) -- sudo bash
60+
```
61+
62+
> Note: the remainder of the commands will be run from within this SSH session.
63+
64+
## Initialize Vault
65+
66+
Obtain the unseal keys from Cloud Storage and decrypt them using Cloud KMS:
67+
68+
```shell
69+
export GOOGLE_PROJECT=$(gcloud config get-value project)
70+
gcloud kms decrypt \
71+
--location=global \
72+
--keyring=vault \
73+
--key=vault-init \
74+
--plaintext-file=/dev/stdout \
75+
--ciphertext-file=<(gsutil cat gs://${GOOGLE_PROJECT}-vault-assets/vault_unseal_keys.txt.encrypted)
76+
```
77+
78+
The output will look like the following:
79+
80+
```
81+
Unseal Key 1: oO1UNH4TPVZRFuGWUa9D0eciJ2LMMgi2PYxm/bLL/lt0
82+
Unseal Key 2: +4q3O9LT46p22uTcDTYZyIVvVt+mxhB8OQ87vZFc3pkp
83+
Unseal Key 3: tFnuYrDD1Xgkec3wFXhk93wIjEfq3kCOD34i16MkE+pl
84+
Unseal Key 4: DFQhkl344Z+jpwr9L/looYjNYPAh8/UKGF5fXAO2Vj0W
85+
Unseal Key 5: XOQVAZCKt6njWcF6IAP19ER1WnRqhH5MllyvcywBLtaw
86+
Initial Root Token: 8d9b6907-0386-c422-cad8-624ceba2d0ae
87+
```
88+
89+
Unseal Vault
90+
91+
```
92+
vault unseal
93+
```
94+
95+
> Run the command above at least 3 times, providing a different unseal key when prompted to unseal Vault.
96+
97+
Verify Vault is unsealed:
98+
99+
```
100+
vault status
101+
```
102+
103+
Authenticate to Vault as root:
104+
105+
```
106+
vault auth ROOT_TOKEN
107+
```
108+
109+
## Configure GCP Auth Backend
110+
111+
Enable GCP auth backend:
112+
113+
```
114+
vault auth-enable gcp
115+
```
116+
117+
Configure GCP backend:
118+
119+
```
120+
vault write auth/gcp/config credentials=@/etc/vault/gcp_credentials.json
121+
```
122+
123+
## Create a Vault role and login with signed JWT
124+
125+
Create a Vault role named `dev-role`:
126+
127+
```
128+
GOOGLE_PROJECT=$(gcloud config get-value project)
129+
vault write auth/gcp/role/dev-role \
130+
type="iam" \
131+
project_id="${GOOGLE_PROJECT}" \
132+
policies="default" \
133+
service_accounts="vault-admin@${GOOGLE_PROJECT}.iam.gserviceaccount.com"
134+
```
135+
136+
Get a signed JWT for the `dev-role`:
137+
138+
```
139+
GOOGLE_PROJECT=$(gcloud config get-value project)
140+
SERVICE_ACCOUNT=vault-admin@${GOOGLE_PROJECT}.iam.gserviceaccount.com
141+
cat - > login_request.json <<EOF
142+
{
143+
"aud": "vault/dev-role",
144+
"sub": "${SERVICE_ACCOUNT}",
145+
"exp": $((EXP=$(date +%s)+600))
146+
}
147+
EOF
148+
```
149+
150+
```
151+
JWT_TOKEN=$(gcloud beta iam service-accounts sign-jwt login_request.json signed_jwt.json --iam-account=${SERVICE_ACCOUNT} && cat signed_jwt.json)
152+
```
153+
154+
Login to Vault with the signed JWT:
155+
156+
```
157+
curl -s ${VAULT_ADDR}/v1/auth/gcp/login -d '{"role": "dev-role", "jwt": "'${JWT_TOKEN}'"}' | jq -r '.auth.client_token' > ~/.vault-token
158+
```
159+
160+
Test access by writing and reading a value to the cubbyhole
161+
162+
```
163+
vault write /cubbyhole/hello value=world
164+
vault read /cubbyhole/hello
165+
```
166+
167+
Expected output:
168+
169+
```
170+
Key Value
171+
--- -----
172+
value world
173+
```

‎example-vault-on-gce/diagram.png

75.1 KB
Loading

‎example-vault-on-gce/main.tf

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/*
2+
* Copyright 2017 Google Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable region {
18+
default = "us-central1"
19+
}
20+
21+
variable zone {
22+
default = "us-central1-b"
23+
}
24+
25+
variable project_id {}
26+
variable storage_bucket {}
27+
variable kms_keyring_name {}
28+
29+
provider google {
30+
region = "${var.region}"
31+
}
32+
33+
module "vault" {
34+
source = "github.com/GoogleCloudPlatform/terraform-google-vault"
35+
project_id = "${var.project_id}"
36+
region = "${var.region}"
37+
zone = "${var.zone}"
38+
machine_type = "n1-standard-4"
39+
storage_bucket = "${var.storage_bucket}"
40+
kms_keyring_name = "${var.kms_keyring_name}"
41+
force_destroy_bucket = true
42+
}

0 commit comments

Comments
 (0)