Vault

# Python에서 Vault 사용 (hvac 라이브러리)
import hvac
import os

# 1. Vault 클라이언트 초기화
client = hvac.Client(
    url=os.environ['VAULT_ADDR'],
    token=os.environ.get('VAULT_TOKEN')
)

# Kubernetes 인증 (Pod 내에서)
def login_with_kubernetes():
    with open('/var/run/secrets/kubernetes.io/serviceaccount/token') as f:
        jwt = f.read()

    client.auth.kubernetes.login(
        role='myapp-role',
        jwt=jwt,
        mount_point='kubernetes'
    )
    return client

# 2. 비밀 읽기 (KV v2)
def get_database_config():
    secret = client.secrets.kv.v2.read_secret_version(
        path='myapp/config',
        mount_point='secret'
    )
    return secret['data']['data']

config = get_database_config()
db_host = config['db_host']
db_pass = config['db_pass']

# 3. 동적 데이터베이스 자격증명
def get_db_credentials():
    creds = client.secrets.database.generate_credentials(
        name='readonly',
        mount_point='database'
    )
    return {
        'username': creds['data']['username'],
        'password': creds['data']['password'],
        'lease_id': creds['lease_id'],
        'lease_duration': creds['lease_duration']
    }

# 4. Transit 암호화
def encrypt_data(plaintext: str) -> str:
    import base64
    encoded = base64.b64encode(plaintext.encode()).decode()

    result = client.secrets.transit.encrypt_data(
        name='my-key',
        plaintext=encoded,
        mount_point='transit'
    )
    return result['data']['ciphertext']

def decrypt_data(ciphertext: str) -> str:
    import base64
    result = client.secrets.transit.decrypt_data(
        name='my-key',
        ciphertext=ciphertext,
        mount_point='transit'
    )
    return base64.b64decode(result['data']['plaintext']).decode()

# External Secrets Operator로 Vault 연동
# Kubernetes Secret을 Vault에서 자동 동기화

# 1. SecretStore 정의 (Vault 연결 설정)
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
  namespace: default
spec:
  provider:
    vault:
      server: "https://vault.example.com:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "myapp-role"
          serviceAccountRef:
            name: "vault-auth"

---
# 2. ExternalSecret 정의 (동기화할 비밀 지정)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: myapp-secrets
  namespace: default
spec:
  refreshInterval: "1h"  # 1시간마다 갱신
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: myapp-secrets  # 생성될 K8s Secret 이름
    creationPolicy: Owner
  data:
    - secretKey: DB_HOST
      remoteRef:
        key: myapp/config
        property: db_host
    - secretKey: DB_PASSWORD
      remoteRef:
        key: myapp/config
        property: db_pass

---
# 3. Pod에서 Secret 사용
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
    - name: app
      image: myapp:latest
      envFrom:
        - secretRef:
            name: myapp-secrets  # 자동 동기화된 Secret