ืืื ืึทื ืืืกืึทืคึผืืืฉืึทื ืคืื ืื ืึธื ืืืื ืคืื ืึท ื ืืึท ืขื ืจืึธืืืืึทื ื ืคึฟืึทืจ ืืขื ืงืืจืก ืืืจ ืืึธืื ืฆืืืขืืจืืื ืึท ืืืืขืจืืขืฆืื ื ืคืื ืึท ื ืืฆืืง ืึทืจืืืงื ืคึฟืึทืจ ืืืจ.
ืืจืึทื ืกืคึผืึทืจืขื ื ืืึทืืึท ืขื ืงืจืืคึผืฉืึทื (TDE) ืืื ืืจืืืก ืืื ืืื MySQL ืคึฟืึทืจ ืืึทื ืฅ ืขืืืขืืข ืืึธื. ืึธืืขืจ ืืึธืื ืืืจ ืืืฅ ืืขืืึทื ืง ืืืขืื ืืื ืขืก ืึทืจืืขื ืืื ืืขืจ ืื ืงืึทืคึผืืขืจ ืืื ืืืึธืก ืคึผืจืึทื TDE ืงืขื ืืึธืื ืืืืฃ ืืืื ืกืขืจืืืขืจ? ืืื ืืขืจ ืกืขืจืืข ืคืื โโโโืึทืจืืืงืืขื ืืืจ ืืืขืื ืงืืงื ืืื ืืื TDE ืึทืจืืขื ืื ืขืืืืื ืืง. ืืึธืืืจ ืึธื ืืืืื ืืื ืฉืืืกื ืกืืึธืจืืืืฉ, ืืืืึทื ืืึธืก ืืื ืคืืจืืื ืื ืคึฟืึทืจ ืงืืื ืขื ืงืจืืคึผืฉืึทื ืฆื ืึทืจืืขืื. ืืขืจื ืึธื ืืืจ ืืืขืื ื ืขืืขื ืึท ื ืขืขื ืืขืจ ืงืืง ืืื ืขื ืงืจืืคึผืฉืึทื ืึทืจืืขื ืืื Percona Server ืคึฟืึทืจ MySQL / MySQL ืืื ืืืึธืก ื ืึธื ืคึฟืขืึดืงืืืื Percona Server for MySQL ืืื.
MySQL Keyring
ืงืืืจืื ื ืืขื ืขื ืคึผืืืืื ืก ืืืึธืก ืืึธืื ืื ืกืขืจืืืขืจ ืฆื ืึธื ืคืจืขื, ืฉืึทืคึฟื ืืื ืืืกืืขืงื ืฉืืืกืืขื ืืื ืึท ืืืืข ืืขืงืข (ืงืืืจืื ื_ืคืืืข) ืึธืืขืจ ืืืืฃ ืึท ืืืืึทื ืกืขืจืืืขืจ (ืึทืืึท ืืื HashiCorp Vault). ืงืื ืืขื ืขื ืฉืืขื ืืืง ืงืึทืฉื ืืึธืืงืึทืื ืฆื ืคืึทืจืืืืขืจื ืืืืขืจ ืจืืืจืืืืึทื.
ืคึผืืืืื ืก ืงืขื ืขื ืืืื ืฆืขืืืืื ืืื ืฆืืืื ืงืึทืืขืืึธืจืืขืก:
- ืืืงืืืข ืกืืึธืจืืืืฉ. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืึท ืืืืข ืืขืงืข (ืืืจ ืจืืคื ืืขื ืึท ืืขืงืข-ืืืืืจื ืงืืืจืื ื).
- ืืืืึทื ืกืืึธืจืืืืฉ. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืึธืื ืกืขืจืืืืจืขืจ (ืืืจ ืจืืคื ืืขื ืึท ืกืขืจืืืขืจ-ืืืืืจื ืงืืืจืื ื).
ืืขืจ ืฆืขืฉืืืืื ื ืืื ืืืืืืืง ืืืืึทื ืคืึทืจืฉืืืขื ืข ืืืืคึผืก ืคืื ืกืืึธืจืืืืฉ ืืืืืืื ืึท ืืืกื ืึทื ืืขืจืฉ, ื ืื ืืืืื ืืืขื ืกืืึธืจืื ื ืืื ืจืืืจืืืืื ื ืฉืืืกืืขื, ืึธืืขืจ ืืืื ืืืขื ืืื ืืืืคื.
ืืืขื ื ืืฆื ืึท ืืขืงืข ืกืืึธืจืืืืฉ, ืืื ืกืืึทืจืืึทืคึผ, ืื ืืื ืฆืข ืืื ืืึทืื ืคืื ืื ืกืืึธืจืืืืฉ ืืื ืืึธืืืื ืืื ืื ืงืึทืฉ: ืฉืืืกื ืฉืืึทื, ืฉืืืกื ืืึทื ืืฆืขืจ, ืฉืืืกื ืืืคึผ ืืื ืืขืจ ืฉืืืกื ืืื.
ืืื ืืขื ืคืึทื ืคืื ืึท ืกืขืจืืืขืจ ืืืึทื ืงืจืึธื (ืึทืืึท ืืื ืืืึธืื ืกืขืจืืืืจืขืจ), ืืืืื ืื ืฉืืืกื ืฉืืึทื ืืื ืฉืืืกื ืืึทื ืืฆืขืจ ืืขื ืขื ืืึธืืืื ืืื ืกืืึทืจืืึทืคึผ, ืึทืืื ืืขืืื ื ืึทืืข ืื ืฉืืืกืืขื ืงืขื ื ืืฉื ืคึผืึทืืขืืขื ืื ืกืืึทืจืืึทืคึผ. ืฉืืืกืืขื ืืขื ืขื ืืึธืืืื ืคืืื. ืึทื ืืื, ืืขืจ ืฉืืืกื ืืื ืืื ืืึธืืืื ืคึฟืื ืืืึธืื ื ืึธืจ ืืืขื ืขืก ืืื ืคืืงืืืฉ ืืืจืฃ. ืึทืืึธื ืืึทืื ืืึธืืืื, ืืขืจ ืฉืืืกื ืืื ืงืึทืฉื ืืื ืืึผืจืื ืึทืืื ืึทื ืขืก ืืึทืจืฃ ื ืื ืืืื ืึทืงืกืขืกื ืืืจื TLS ืงืึทื ืขืงืฉืึทื ื ืฆื ืื ืืืึธืื ืกืขืจืืืืจืขืจ ืืื ืืขืจ ืฆืืงืื ืคึฟื. ืืขืจื ืึธื, ืืึธืืืจ ืืขื ืืืึธืก ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืคืึธืจืฉืืขืื ืืื ืื ืฉืืืกื ืงืจืึธื.
ืืขืจ ืฉืืืกื ืืื ืคึฟืึธืจืืึทืฆืืข ืึผืืื ืื ืคืืืืขื ืืข:
- ืฉืืืกื ืฉืืึทื - ืฉืืืกื ืืืืขื ืืืืขื, ืืืฉื:
INNODBKey-764d382a-7324-11e9-ad8f-9cb6d0d5dc99-1 - ืฉืืืกื ืืืคึผ - ืฉืืืกื ืืืคึผ ืืืืืจื ืืืืฃ ืื ืขื ืงืจืืคึผืฉืึทื ืึทืืืขืจืืืึทื ืืขื ืืฆื, ืืขืืืขื ืืืึทืืืขืก: "AES", "RSA" ืึธืืขืจ "DSA".
- ืฉืืืกื ืืขื ื - ืฉืืืกื ืืขื ื ืืื ืืืืขืก, AES: 16, 24 ืึธืืขืจ 32, RSA 128, 256, 512 ืืื DSA 128, 256 ืึธืืขืจ 384.
- ืืึทื ืืฆืขืจ - ืืึทืืืฆืขืจ ืคืื ืื ืฉืืืกื. ืืืื ืืขืจ ืฉืืืกื ืืื ืกืืกืืขื, ืคึฟืึทืจ ืืืึทืฉืคึผืื, Master Key, ืืึธืก ืคืขืื ืืื ืืืืืืง. ืืืื ืึท ืฉืืืกื ืืื ืืืฉืืคื ืืื keyring_udf, ืืึธืก ืคืขืื ืืืืขื ืึทืคืืื ืื ืืึทืืืฆืขืจ ืคืื ืืขื ืฉืืืกื.
- ืืขืจ ืฉืืืกื ืืื
ืืขืจ ืฉืืืกื ืืื ืืื ืฆืืง ืืืืขื ืึทืคืืื ืืืจื ืื ืคึผืึธืจ: key_id, ืืึทื ืืฆืขืจ.
ืขืก ืืขื ืขื ืืืื ืืืคืขืจืึทื ืกืื ืืื ืกืืึธืจืื ื ืืื ืืืืืืื ื ืฉืืืกืืขื.
ืืขืงืข ืกืืึธืจืืืืฉ ืืื ืคืึทืกืืขืจ. ืืืจ ืืื ืืจืึทืืื ืึทื ืึท ืฉืืืกื ืงืจืึธื ืืื ืคืฉืื ืฉืจืืึทืื ืืขื ืฉืืืกื ืฆื ืึท ืืขืงืข ืึทืืึธื, ืึธืืขืจ ื ืื, ืขืก ืก ืืขืจ ืืขืืื ืืขื ืืืืฃ ืืึธ. ืืืขื ืึท ืืขืงืข ืกืืึธืจืืืืฉ ืืึธืืืคืืงืึทืืืึธื ืืื ืืขืืืื, ืึท ืืึทืงืึทืคึผ ืงืึธืคึผืืข ืคืื โโืึทืืข ืืื ืืึทืื ืืื ืขืจืฉืืขืจ ืืืฉืืคื. ืืื ืก ืืึธืื ืื ืืขืงืข ืืื ืืขืจืืคื my_biggest_secrets, ืืขืืึธืื ืืขืจ ืืึทืงืึทืคึผ ืงืึธืคึผืืข ืืืขื ืืืื my_biggest_secrets.backup. ืืขืจื ืึธื, ืื ืงืึทืฉ ืืื ืคืืจืขื ืืขืจื (ืงืื ืืขื ืขื ืืืกืืฃ ืึธืืขืจ ืืืืกืืขืืขืงื) ืืื ืืืื ืึทืืฅ ืืื ืืขืจืึธืื, ืื ืงืึทืฉ ืืื ืืึทืฉืืขืืืง ืฆื ืึท ืืขืงืข. ืืื ืืขืืื ืงืึทืกืขืก, ืึทืืึท ืืื ืึท ืกืขืจืืืขืจ ืืืจืืคืึทื, ืืืจ ืงืขื ืืขื ืืขื ืืึทืงืึทืคึผ ืืขืงืข. ืื ืืึทืงืึทืคึผ ืืขืงืข ืืื ืืืืกืืขืืขืงื ืื ืืืืึทืืขืจ ืืึธื ืื ืฉืืืกืืขื ืืขื ืขื ืืึธืืืื (ืืืืฉืึทืืืึทืื ื ืึธื ืื ืกืขืจืืืขืจ ืืื ืจืืกืืึทืจืืื).
ืืืขื ืืืจ ืฉืคึผืึธืจื ืึธืืขืจ ืืืกืืขืงื ืึท ืฉืืืกื ืืื ืึท ืกืขืจืืืขืจ ืกืืึธืจืืืืฉ, ืื ืกืืึธืจืืืืฉ ืืืื ืคืึทืจืืื ืื ืฆื ืื MySQL ืกืขืจืืืขืจ ืืื ืื ืงืึทืืึทื ืื "ืฉืืงื ืืขื ืฉืืืกื" / "ืืขืื ืฉืืืกื ืืืืืฉืึทื".
ืืื ืก ืฆืืจืืงืงืืืขื ืฆื ืกืขืจืืืืจืขืจ ืกืืึทืจืืึทืคึผ ืืืืงืืึทื. ืืื ืึทืืืฉืึทื ืฆื ืื ืงืึทืืขืจ ืืืืงืืึทื ืืื ืึทืคืขืงืืึทื ืืืจื ืื ืืืึธืื ืืื, ืขืก ืืื ืืืื ืื ืึทืจืืืกืืขืื ืคืื ืืื ืคืืืข ืงืื ืคืื ืื ืืืึธืื ืืึทืจืคึฟื ืฆื ืืืื ืจืืืจืืืื ืืื ืกืืึทืจืืึทืคึผ. ืคืื ืงืืจืก, ืืึธืก ืืื ืกืคึผืขืฆืืขื ืืืืืืืง ืคึฟืึทืจ ืกืขืจืืืขืจ ืกืืึธืจืืืืฉ. ืืื ืกืืึทืจืืึทืคึผ, ืืขืจ ืกืขืจืืืขืจ ืืฉืขืงืก ืืืึธืก ืฉืืืกื ืืื ืคืืจืืื ืื ืคึฟืึทืจ ืื ืงืจืืคึผืืื ืืืฉื / ืืืฉื ืกืคึผืืืกืึทื ืืื ืจืืงืืืขืก ืื ืฉืืืกื ืคึฟืื ืื ืกืืึธืจืืืืฉ. ืืืืฃ ืึท "ืจืืื" ืกืขืจืืืขืจ ืืื Master Key ืขื ืงืจืืคึผืฉืึทื, ืขืก ืืืื ืืืื ืืืื Master Key, ืืืึธืก ืืืื ืืืื ืจืืืจืืืื ืคืื ืกืืึธืจืืืืฉ. ืึธืืขืจ, ืึท ืืจืขืกืขืจืข ื ืืืขืจ ืคืื ืฉืืืกืืขื ืงืขื ืืืื ืคืืจืืื ืื, ืืืฉื, ืืืขื ืื ืืึทืงืึทืคึผ ืกืขืจืืืขืจ ืจืืกืืึธืจื ืึท ืืึทืงืึทืคึผ ืคืื ืื ืขืจืฉืืืง ืกืขืจืืืขืจ. ืืื ืึทืืึท ืงืึทืกืขืก, ืจืึธืืืืืฉืึทื ืคืื ืื ืืืจ ืฉืืืกื ืืึธื ืืืื ืฆืืืขืฉืืขืื. ืืึธืก ืืืขื ืืืื ืืืืขืงื ืืื ืืขืจ ืืขืืึทื ืืื ืฆืืงืื ืคึฟื ืึทืจืืืงืืขื, ืืึธืืฉ ืืึธ ืืื ืืืึธืื ืืื ืฆื ืืึธื ืึทื ืึท ืกืขืจืืืขืจ ื ืืฆื ืงืืืคื ืืืจ ืงืื ืงืขื ื ืขืืขื ืึท ืืืกื ืืขืจ ืฆื ืึธื ืืืืื, ืกืคึผืขืฆืืขื ืืืขื ืืืจ ื ืืฆื ืึท ืกืขืจืืืขืจ ืืืึทื ืฉืืืกื ืงืจืึธื.
ืืืฆื ืืึธืื ืืื ืื ืจืขืื ืึท ืืืกื ืืขืจ ืืืขืื keyring_file. ืืืขื ืืื ืืื ืืขืืืขื ืืขืืืขืืึธืคึผืื ื keyring_file, ืืื ืืื ืืขืืืขื ืืืื ืืืจืื ืืืขืื ืืื ืฆื ืงืึธื ืืจืึธืืืจื ืคึฟืึทืจ Keyring_file ืขื ืืขืจืื ืืขื ืืฉืขืช ืื ืกืขืจืืืขืจ ืืื ืคืืืกื ืืืง. ืืื 5.7, ืื ืืฉืขืง ืืื ืืืจืืืขืงืึธืื ืืืืืจื ืืืืฃ ืืขืงืข ืกืืึทืืืกืืืง, ืืืึธืก ืืื ื ืืฉื ืึทื ืืืืขืื ืืืืืื ื, ืืื ืืื 8.0 ืขืก ืืื ืืขืืืขื ืจืืคึผืืืืกื ืืื ืึท SHA256 ืืฉืขืงืงืกืื.
ืืขืจ ืขืจืฉืืขืจ ืืึธื ืืืจ ืืืืคื keyring_file, ืืขืงืข ืกืืึทืืืกืืืง ืืื ืึท ืืฉืขืงืงืกืื ืืขื ืขื ืงืึทืืงืืึทืืืืืื, ืืืึธืก ืืขื ืขื ืืขืจืืื ื ืืืจื ืื ืกืขืจืืืขืจ, ืืื ืขื ืืขืจืื ืืขื ืืขื ืขื ืืืืื ืืขืืืขื ืื ืืืื ืืื ืืืืึทืื. ืืืขื ืืขืจ ืืขืงืข ืขื ืืขืจืื ืืขื, ืื ืืฉืขืงืงืกืื ืืื ืืขืจืืืึทื ืืืงื.
ืืืจ ืืึธืื ืฉืืื ืงืึทืืืขืจื ืคืืืข ืคึฟืจืืื ืืืขืื ืฉืืืกื ืืืึธืืฅ. ืึธืืขืจ, ืขืก ืืื ืื ืื ืืขืจ ืืืืืืืง ืืขืืข ืืืึธืก ืืื ืึธืคื ืคืืจืืขืกื ืึธืืขืจ ืืืกืึทื ืืขืจืกืืื: ืืึทื ืืืืืื ื ืฉืืืกืืขื ืึทืจืืืขืจ ืกืขืจืืืขืจืก.
ืืืืก ืืืื ืืื? ืืขืืขืจ ืกืขืจืืืขืจ (ืืืฉื, ืคึผืขืจืงืึธื ืึท ืกืขืจืืืืจืขืจ) ืืื ืืขื ืงื ืืื ืืืื ืืึธืื ืึท ืืึทืืื ืืขืจ ืึธืจื ืืืืฃ ืื ืืืึธืื ืกืขืจืืืืจืขืจ ืืื ืืืึธืก ืคึผืขืจืงืึธื ืึท ืกืขืจืืืืจืขืจ ืืืื ืงืจืึธื ืืืึทื ืฉืืืกืืขื. ืืขืืขืจ ืืขื ืงืื ืืขืจืืืขืืืขื ืืื ืื ืกืืึธืจืืืืฉ ืึผืืื ืื GUID ืคืื ืื ืคึผืขืจืงืึธื ืึท ืกืขืจืืืืจืขืจ ืืื ืืืื ืืืืขื ืืืืขื. ืคืืจืืืืก ืืื ืขืก ืืืืืืืง? ืืืึทืืืฉืึทื ืึทื ืืืจ ืืึธื ืืืืื ืืืื ืืืึธืื ืกืขืจืืืืจืขืจ ืืื ืึทืืข ืคึผืขืจืงืึธื ืึท ืกืขืจืืืขืจืก ืืื ืืขื ืงื ืืื ื ืืฆื ืืขื ืืืื ืืืึธืื ืกืขืจืืืืจืขืจ. ืื ืคึผืจืึธืืืขื ืืืื ื ืงืืึธืจ ืืื ืืขืจ ืืึธื. ืืืื ืึทืืข ืคึผืขืจืงืึธื ืึท ืกืขืจืืืขืจืก ืืขืืืืื ื ืึท ืืืจ ืงืื ืึธื ืืื ืฆืืง ืืืขื ืืืคืืขืจืก, ืึทืืึท ืืื ืฉืืึทื = 1, ืฉืืึทื = 2, ืืื"ื ื, ืึทืืข ืกืขืจืืืขืจืก ืืื ืืขื ืงื ืืื ืืืึธืื ื ืืฆื ืื ืืขืืืข ืืืจ ืงืื. ืืืึธืก ืื GUID ืืื ืืื ืื ืืืกืืื ืืงืฉืึทื ืฆืืืืฉื ืกืขืจืืืขืจืก. ืคืืจืืืืก ืจืขืื ืืืขืื ืืึทื ืืืืืื ื ืฉืืืกืืขื ืฆืืืืฉื ืกืขืจืืืขืจืก ืืืื ืขืก ืืื ืฉืืื ืึท ืืื ืฆืืง GUID? ืขืก ืืื ืื ืื ืืขืจ ืคึผืืืืื - keyring_udf. ืืื ืืขื ืคึผืืืืื, ืืืื ืกืขืจืืืืจืขืจ ืืึทื ืืฆืขืจ ืงืขื ืขื ืงืจืึธื ืืืืขืจ ืฉืืืกืืขื ืืืืฃ ืื ืืืึธืื ืกืขืจืืืขืจ. ืืขืจ ืคึผืจืึธืืืขื ืึทืงืขืจื ืืืขื ืึท ืืึทื ืืฆืขืจ ืงืจืืืืฅ ืึท ืฉืืืกื ืืืืฃ ืกืขืจืืืขืจ 1, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืื ืืขืืึธืื ืคืจืืืื ืฆื ืฉืึทืคึฟื ืึท ืฉืืืกื ืืื ืืขืจ ืืขืืืืงืขืจ ืฉืืึทื ืืืืฃ ืกืขืจืืืขืจ 2, ืคึฟืึทืจ ืืืึทืฉืคึผืื:
--server1:
select keyring_key_store('ROB_1','AES',"123456789012345");
1
--1 ะทะฝะฐัะธั ััะฟะตัะฝะพะต ะทะฐะฒะตััะตะฝะธะต
--server2:
select keyring_key_store('ROB_1','AES',"543210987654321");
1ืืืึทืจืื. ืืืืืข ืกืขืจืืืขืจืก ื ืืฆื ืื ืืขืืืข ืืืึธืื ืกืขืจืืืืจืขืจ, ืืึธื ืื keyring_key_store ืคืื ืงืฆืืข ื ืื ืคืึทืจืืึธืื ืืืืฃ ืกืขืจืืืขืจ 2? ืื ืืขืจืขืกืืื ืืื, ืืืื ืืืจ ืคึผืจืืืืจื ืฆื ืืึธื ืื ืืขืืืข ืืืืฃ ืืืื ืกืขืจืืืขืจ, ืืืจ ืืืขื ืืึทืงืืืขื ืึท ืืขืืช:
--server1:
select keyring_key_store('ROB_1','AES',"123456789012345");
1
select keyring_key_store('ROB_1','AES',"543210987654321");
0ืึทื ืก ืจืขืื, ROB_1 ืฉืืื ืืืืืกืฅ.
ืืืืืจ ืงืืื ืืืกืงืืืืจื ืืขื ืฆืืืืืื ืืืืฉืคืื. ืืื ืืืจ ืืขืืืื ืคืจืืขืจ, keyring_vault ืึธืืขืจ ืงืืื ืื ืืขืจืข ืงืืจืื ื ืคึผืืืืื ืงืึทืฉ ืึทืืข ืฉืืืกื IDs ืืื ืืึผืจืื. ืึทืืื, ื ืึธื ืงืจืืืืืื ื ืึท ื ืืึทืข ืฉืืืกื, ROB_1 ืืื ืืืกืืฃ ืฆื ืกืขืจืืืขืจ1, ืืื ืืื ืึทืืืฉืึทื ืฆื ืฉืืงื ืืขื ืฉืืืกื ืฆื ืืืึธืื, ืืขืจ ืฉืืืกื ืืื ืืืื ืืืกืืฃ ืฆื ืื ืงืึทืฉ. ืืืฆื, ืืืขื ืืืจ ืคึผืจืืืืจื ืฆื ืืืืื ืื ืืขืืืข ืฉืืืกื ืึท ืฆืืืืื ืืึธื, keyring_vault ืืฉืขืงืก ืฆื ืืขืจ ืฉืืืกื ืืืืืกืฅ ืืื ืื ืงืึทืฉ ืืื ืืืืจืคื ืขืจ ืึท ืืขืืช.
ืืื ืืขืจ ืขืจืฉืืขืจ ืคืึทื ืื ืกืืืืึทืฆืืข ืืื ืึทื ืืขืจืฉ. ืกืขืจืืืขืจ 1 ืืื ืกืขืจืืืขืจ 2 ืืึธืื ืืึทืืื ืืขืจ ืงืึทืืฉืขืก. ื ืึธื ืึทืืื ื ROB_1 ืฆื ืื ืฉืืืกื ืงืึทืฉ ืืืืฃ ืกืขืจืืืขืจ 1 ืืื ืื ืืืึธืื ืกืขืจืืืขืจ, ืืขืจ ืฉืืืกื ืงืึทืฉ ืืืืฃ ืกืขืจืืืขืจ 2 ืืื ื ืืฉื ืกืื ืง. ืขืก ืืื ืงืืื ROB_2 ืฉืืืกื ืืื ืื ืงืึทืฉ ืืืืฃ ืกืขืจืืืขืจ 1. ืืืื, ืืขืจ ROB_1 ืฉืืืกื ืืื ืืขืฉืจืืื ืฆื ืื keyring_key_store ืืื ืฆื ืื ืืืึธืื ืกืขืจืืืขืจ, ืืืึธืก ืึทืงืฉืื ืึธืืืืขืจืจืืืฅ (!) ืื ืคืจืืขืจืืืงืข ืืืขืจื. ืืืฆื ืื ROB_1 ืฉืืืกื ืืืืฃ ืื ืืืึธืื ืกืขืจืืืขืจ ืืื 543210987654321. ืื ืืขืจืขืกืืื ืืื, ืื ืืืึธืื ืกืขืจืืืขืจ ืืื ื ืืฉื ืคืึทืจืฉืคึผืึทืจื ืึทืืึท ืึทืงืฉืึทื ื ืืื ืืืืื ืึธืืืืขืจืจืืืฅ ืื ืึทืื ืืืขืจื.
ืืืฆื ืืืจ ืงืขื ืขื ืืขื ืืืึธืก ืกืขืจืืืขืจ ืคึผืึทืจืืืฉืึทื ืื ื ืืื ืืืึธืื ืงืขื ืขื ืืืื ืืืืืืืง - ืืืขื ืืืจ ื ืืฆื keyring_udf ืืื ืืืจ ืืืืื ืฆื ืงืจืึธื ืฉืืืกืืขื ืืื ืืืึธืื. ืืื ืฆื ืืขืจืืจืืืื ืืขื ืฆืขืฉืืืืื ื ืืืืฃ ืึท ืืืึธืื ืกืขืจืืืขืจ?
ืขืก ืืขื ืขื ืฆืืืื ืืืขืื ืฆื ืฆืขืืืืื ืืื ืืืึธืื. ืืืจ ืงืขื ืขื ืืึทืื ืคืึทืจืฉืืืขื ืข ืืืจื ืืืืืื ืคึฟืึทืจ ืืขืืขืจ ืกืขืจืืืขืจ, ืึธืืขืจ ื ืืฆื ืคืึทืจืฉืืืขื ืข ืคึผืึทืืก ืืื ืืขืจ ืืขืืืืงืขืจ ืืืจื ืคืื ื. ืืึธืก ืืื ืืขืกืืขืจ ืืืืืกืืจืืจื ืืื ืืืืฉืคืืื. ืึทืืื ืืึธืื ืก ืงืืง ืืื ืื ืืืื ืืืจื ืคืื ืงืื ืขืจืฉืืขืจ:
--server1:
vault_url = http://127.0.0.1:8200
secret_mount_point = server1_mount
token = (...)
vault_ca = (...)
--server2:
vault_url = http://127.0.0.1:8200
secret_mount_point = sever2_mount
token = (...)
vault_ca = (...)ืืึธ ืืืจ ืงืขื ืขื ืืขื ืึทื ืกืขืจืืืขืจ1 ืืื ืกืขืจืืืขืจ2 ื ืืฆื ืคืึทืจืฉืืืขื ืข ืืืจื ืคืื ืงืื. ืืืขื ืกืคึผืืืืื ื ืื ืคึผืึทืืก, ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืขื ืงืืงื ืืื ืืึธืก:
--server1:
vault_url = http://127.0.0.1:8200
secret_mount_point = mount_point/server1
token = (...)
vault_ca = (...)
--server2:
vault_url = http://127.0.0.1:8200
secret_mount_point = mount_point/sever2
token = (...)
vault_ca = (...)ืืื ืืขื ืคืึทื, ืืืืืข ืกืขืจืืืขืจืก ื ืืฆื ืื ืืขืืืข ืืืจื ืคืื ื "mount_point", ืึธืืขืจ ืคืึทืจืฉืืืขื ืข ืคึผืึทืืก. ืืืขื ืืืจ ืืึทืื ืืขืจ ืขืจืฉืืขืจ ืกืื ืืืืฃ ืกืขืจืืืขืจ 1 ื ืืฆื ืืขื ืืจื, ืื ืืืึธืื ืกืขืจืืืขืจ ืืืืืึธืืึทืืืฉ ืงืจืืืืฅ ืึท "ืกืขืจืืืขืจ 1" ืืืขืืืืืึทืืขืจ. ืคึฟืึทืจ ืกืขืจืืืขืจ 2 ืึทืืฅ ืืื ืขื ืืขื. ืืืขื ืืืจ ืืืกืืขืงื ืื ืืขืฆืืข ืกืื ืืื mount_point/server1 ืึธืืขืจ mount_point/server2, ืื ืืืึธืื ืกืขืจืืืขืจ ืืืื ืืืืืฅ ืื ืืืจืขืงืืขืจืื. ืืื ืคืึทื ืืืจ ื ืืฆื ืืจื ืฆืขืฉืืืืื ื, ืืืจ ืืืื ืฉืึทืคึฟื ืืืืื ืืืื ืึธื ืงืืึทืคึผื ืคืื ื ืืื ืืืืฉื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก ืึทืืื ืึทื ืื ืกืขืจืืืขืจืก ื ืืฆื ืืึทืืื ืืขืจ ืคึผืึทืืก. ื ืืืจื ืคืื ื ืงืขื ืขื ืืืื ืืืฉืืคื ืืื ืึท ืืืืคึผ ืืขืื. ื ืืฆื CURL ืืึธืก ืงืขื ืืืื ืืขืืื ืืื ืืึธืก:
curl -L -H "X-Vault-Token: TOKEN" โcacert VAULT_CA
--data '{"type":"generic"}' --request POST VAULT_URL/v1/sys/mounts/SECRET_MOUNT_POINTืึทืืข ืคืขืืืขืจ (TOKEN, VAULT_CA, VAULT_URL, SECRET_MOUNT_POINT) ืฉืืืืขื ืฆื ืื ืคึผืึทืจืึทืืขืืขืจืก ืคืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข. ืคืื ืงืืจืก, ืืืจ ืงืขื ืขื ื ืืฆื Vault ืืืืืืึทืืื ืฆื ืืึธื ืื ืืขืืืข. ืืืขืจ ืขืก ืืื ืืจืื ืืขืจ ืฆื ืึธืืึทืืืื ืื ืฉืึทืคืื ื ืคืื ืึท ืืึทืจื ืคืื ื. ืืื ืืึธืคึฟื ืืืจ ืืขืคึฟืื ืขื ืื ืืื ืคึฟืึธืจืืึทืฆืืข ื ืืฆืืง ืืื ืืืจ ืืืขืื ืืขื ืืืจ ืืื ืื ืืืืึทืืขืจ ืึทืจืืืงืืขื ืืื ืืขื ืกืขืจืืข.
ืืืืขื ืขื ืืขืจ:
ืืงืืจ: www.habr.com