GuyBarros

# HashiCorp Vault Enterprise – Automação de PKI e Certificados

## Introdução

O HashiCorp Vault Enterprise oferece um mecanismo de PKI (Public Key Infrastructure) nativo e altamente escalável, capaz de atuar como Autoridade Certificadora raiz ou intermediária, emitir e revogar certificados X.509 com validade curta (short-lived) e integrar-se a qualquer infraestrutura que consuma TLS. Em ambientes corporativos modernos, a rotação manual de certificados é fonte recorrente de incidentes de disponibilidade e falhas de segurança; a automação via Vault elimina esse risco ao garantir que certificados sejam renovados programaticamente, com auditoria completa, sem intervenção humana.

Este documento detalha cinco casos de uso práticos de automação de PKI com Vault Enterprise, cada um acompanhado de exemplos completos em Terraform HCL seguindo o guia de estilo oficial da HashiCorp, trechos de configuração do Vault Agent e pontos de atenção operacionais. Todos os exemplos assumem Vault Enterprise **≥ 1.15** rodando com

GuyBarros

#! /bin/bash
################################
# Requirements: curl, jq
################################

## avoid the last trailling forward slash /

usage="$(basename "$0") [-a consul_http_address] [-t acl_token] [-e IS_ENTERPRISE] [-l LIST_INSTACES]
where 
    -a Consul HTTP(s) Address.

GuyBarros

#!/bin/bash
#script to set up Vault with TLS on EKS, mostly copied from here: https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-minikube-tls#install-the-vault-helm-chart
# Update kubeconfig after deploying each EKS cluster
#DC1
aws eks --region $(terraform output -raw region) update-kubeconfig --name $(terraform output -raw cluster_name_cluster1)

#Kubectl get clusters
kubectl config get-clusters

# update these variables every deploy

GuyBarros

export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=
export VAULT_NAMESPACE=
export KMIP_PATH=kmip


# Iterate over the KMIP Secret Engine to get all Scopes
KMIP_SCOPES=$(curl -H "X-Vault-Token: ${VAULT_TOKEN}" -H "X-Vault-Request: true" "${VAULT_ADDR}/v1/${KMIP_PATH}/scope?list=true" | jq -r '.data.keys[]' )
# KMIP_SCOPES=$(curl -H "X-Vault-Token: ${VAULT_TOKEN}" -H "X-Vault-Request: true" -H "X-Vault-Namespace: ${VAULT_NAMESPACE}" "${VAULT_ADDR}/v1/${KMIP_PATH}/scope?list=true" | jq -r '.data.keys[]' )

GuyBarros

#!/usr/bin/env bash
set -euo pipefail

# --- Config (override via env or CLI) -----------------------------------------
VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
VAULT_TOKEN="${VAULT_TOKEN:-root}"
VAULT_NAMESPACE="${VAULT_NAMESPACE:-}"         # e.g., "admin" or "" for root
TRANSIT_PATH="${TRANSIT_PATH:-transit}"        # mount path of transit (e.g., "transit")
KEY_NAME="${KEY_NAME:-dek-demo}"               # transit key name (must exist)
MESSAGE="${MESSAGE:-hello-envelope}"           # message to encrypt

GuyBarros

#!/usr/bin/env bash
set -euo pipefail

# ================== Config (env overrides allowed) ============================
VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
VAULT_TOKEN="${VAULT_TOKEN:?set VAULT_TOKEN}"
VAULT_NAMESPACE="${VAULT_NAMESPACE:-}"            # leave empty if not using namespaces

TRANSIT_MOUNT="${TRANSIT_MOUNT:-transit}"         # transit mount
HOTP_KEY_NAME="${HOTP_KEY_NAME:-hotp-demo}"       # transit HMAC key name

GuyBarros

#! /bin/bash
################################
# Requirements: curl, jq
################################

## avoid the last trailling forward slash /

usage="$(basename "$0") [-a consul_http_address] [-t acl_token] [-e IS_ENTERPRISE] [-l LIST_INSTACES]
where 
    -a Consul HTTP(s) Address.

GuyBarros

#!/bin/bash
#
# Usage: Pass in a Terraform State file through a pipe
# e.g.
# cat terraform.tfstate | count.sh


# For each resource in the TF State file...
# we only count managed resources (i.e. not data sources)
# we explicitly ignore null resources (terraform_data and null_resource)

GuyBarros

#!/bin/bash

minutes=30 # Note that this script may take up to 30m to run, or longer if `minutes=30` was changed.

# The count_secrets.sh script is intended to be used to query the sys/metrics endpoint of a Vault cluster and extract the
# sum of all KV secrets counts across all namespaces.  This relies on the
# https://developer.hashicorp.com/vault/docs/configuration/telemetry#usage_gauge_period configuration not being disabled,
# and on
# https://developer.hashicorp.com/vault/docs/configuration/telemetry#prometheus_retention_time not being set to 0.
#

GuyBarros

export VAULT_ADDR=https://localhost:8200
export VAULT_TOKEN=root

# Root CA
vault secrets enable -path=pki_root pki
# tune to 10 years
vault secrets tune -max-lease-ttl=87600h pki_root

# Generate internal certificate
vault write -field=certificate pki_root/root/generate/internal \