# 首先啟用數(shù)據(jù)庫(kù)密碼引擎
$ vault secrets enable database
# 創(chuàng)建 MySQL 數(shù)據(jù)庫(kù)配置
$ export MYSQL_URL=x.x.x.x:3306
$ vault write database/config/mydb \
????plugin_name=mysql-database-plugin \
????connection_url="{{username}}:{{password}}@tcp($MYSQL_URL)/" \
????allowed_roles="mydb-crud" \
????username="root" \
????password="******"
# 說(shuō)明：該用戶需要具有用戶管理權(quán)限，此處直接使用 root
# 創(chuàng)建 mydb-crud 角色（具有增刪改查完整權(quán)限）
$ vault write database/roles/mydb-crud \
????db_name=mydb \
????creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT, INSERT, DELETE, UPDATE ON mydb.* TO '{{name}}'@'%';" \
????default_ttl="2m" \
????max_ttl="10m"
# 說(shuō)明：為方便測(cè)試，此處 TTL 設(shè)置較小，實(shí)際使用時(shí)需要評(píng)估合理的值
# 測(cè)試獲取 mydb-crud 角色的憑據(jù)，并查看驗(yàn)證
$ vault read database/creds/mydb-crud
$ vault list sys/leases/lookup/database/creds/mydb-crud

# 啟用 Approle 認(rèn)證引擎
$ vault auth enable approle
# 創(chuàng)建權(quán)限策略 mydb-policy
$ vault policy write mydb-policy -<<EOF
#獲取憑據(jù)的權(quán)限
path "database/creds/mydb-crud" {
??capabilities = [ "read" ]
}
#續(xù)租憑據(jù)的權(quán)限
path "sys/leases/+/database/creds/mydb-crud/*"?{
? capabilities = [ "update" ]
}
EOF
# 創(chuàng)建具有 mydb-policy 權(quán)限的 AppRole
$ vault write auth/approle/role/myapp token_policies="mydb-policy" \
????token_ttl=2m token_max_ttl=10m
# 查看創(chuàng)建的 AppRole
$ vault read auth/approle/role/myapp

# 獲取 RoleID
$ vault read -field=role_id auth/approle/role/myapp/role-id >~/.roleid
# 獲取 SecretID
$vault write -f -field=secret_id auth/approle/role/myapp/secret-id >~/.secretid

auto_auth {
  method {
    type   = "approle"
    config = {
      role_id_file_path = "/vault/config/approle/roleid"
      secret_id_file_path = "/vault/config/approle/secretid"
      remove_secret_id_file_after_reading = false
    }
  }
  sink "file" {
      config = {
          path = "/tmp/.vault-token-via-agent"
      }
  }
}

template_config {
  exit_on_retry_failure = true
}
template {
  error_on_missing_key = true
  source = "/vault/config/appconf/config.ctmpl"
  destination = "/vault/config/appconf/config.yaml.tmp"
  exec {
    command = ["dd", "if=/vault/config/appconf/config.yaml.tmp", "of=/vault/config/appconf/config.yaml" ]
    timeout = "5s"
  }
}

# config.ctmpl
database:
  mysql:
    {{- with secret "database/creds/mydb-crud" }}
    username: {{ .Data.username }}
    password: {{ .Data.password }}
    {{- end }}
    address : x.x.x.x:3306
    dbname  : mydb
    options : charset=utf8mb4&parseTime=True&loc=Local

var (
    mysqlUsername string
    mysqlPassword string
    mysqlAddress  string
    mysqlDBname   string
    mysqlOptions  string
)
func initConfig() {
    mysqlUsername = Config.Database.MySQL.Username
    mysqlPassword = Config.Database.MySQL.Password
    mysqlAddress = Config.Database.MySQL.Address
    mysqlDBname = Config.Database.MySQL.DBname
    mysqlOptions = Config.Database.MySQL.Options
}
func connectMySQL() (*gorm.DB, error) {
    msyqlDSN := fmt.Sprintf("%s:%s@tcp(%s)/%s?%s", mysqlUsername,
        mysqlPassword, mysqlAddress, mysqlDBname, mysqlOptions)
    return gorm.Open(mysql.Open(msyqlDSN), &gorm.Config{})
}

var db *gorm.DB
var dbLocker sync.Mutex
func reconnectMySQL() {
    // get new mysql creds
    creds := getNewMySQLCreds()
    if creds.Username == mysqlUsername && creds.Password == mysqlPassword {
        log.Println("MySQL creds not changed, skip mysql reconnection.")
        return
    }
    dbLocker.Lock()
    defer dbLocker.Unlock()
    // re-connect mysql with new creds
    mysqlUsername = creds.Username
    mysqlPassword = creds.Password
    d, err := connectMySQL()
    if err != nil {
        log.Println("MySQL connect failed:", err)
        return
    }
    // setupDatabase(d)
    db = d
}