Test Markdown Collapse

README.md

Shamir Secret Holder

A Shamir Secret holder is responsible for being available to unseal vault when starting it up.

Requirements

• Vault Binary
• GPG Key

Responsibilities

• Help unseal Vault
  Use the Vault client and your Shamir secret key to unseal Vault.

  $ vault unseal
  

Vault Admin

The Vault Admin is responsible for ensuring the vault service and its backend are available. They also manage the bringup process in the event of an outage, including coordination of the shamir secret holders during the process of unsealing the vault.

Requirements

• SSH access to VMs
  Vault admins may occassionally require ssh access to the underlying operating system. To verify you have access, execute the following:

  # Clone the vault repository
  $ git clone foo
  
  # Execute an ansible ping to ensure you have ssh access
  $ ./runner.sh ansible-ping -i inventories/dev
  

• Access to remote Docker daemon
  The remote Docker daemons are protected via TLS certificates and as a result you must have the following files in place to connect:

  • ~/.docker/ca.pem
  • ~/.docker/cert.pem
  • ~/.docker/key.pem

  Verify that you have access by running the following:

  $ DOCKER_HOST=<docker_hostname>:2376 docker info
  

Responsibilities

• Configure Secret Backends
  Vault admins configure secret backends when necessary...

• Ensure Vault Service is Available
  Vault Admins ensure the the Vault service and underlying infrastructure are up and available...

Global Policy Admin

The Global Policy Admin is responsible for creating, updating, and deleting vault global namespace policies. Vault policies are HCL documents that describe what parts of Vault a user is allowed to access.

Requirements

• Access to port 8200 of the vault servers

Policies

• Global Policy Admin

  # ---------------------------------------------------------------------
  # policy-global-policy_admin.hcl
  # ---------------------------------------------------------------------
  
  # Allow global policy admins to CRUDL all policies
  path "sys/policy/*" {
    capabilities = ["read", "write", "update", "delete", "list"]
  }
  

Responsibilities

• Manage Namspace Admins
• Manage Global Policies

Namespace Policy Admin

The Namespace Policy Admin is responsible for creating, updating, and deleting vault namespace policies. Vault policies are HCL documents that describe what parts of Vault a user is allowed to access.

Requirements

• Vault binary/library
• Access to port 8200 of the vault servers

Policies

• Namespace Admin

  # ---------------------------------------------------------------------
  # policy-<namespace>-policy_admin.hcl
  # ---------------------------------------------------------------------
  
  # Allow <namespace> policy admins to CRUDL all <namespace> policies
  path "sys/policy/<namespace>/*" {
    capabilities = ["read", "write", "update", "delete", "list"]
  }
  

Secret Reader

A Secret Reader is responsible for reading and listing a secret.

Policies

• policy---read

  # ---------------------------------------------------------------------
  # policy-<namespace>-<secret>-read.hcl
  # ---------------------------------------------------------------------
  
  # Allow a secret reader to RL a secret
  path "<backend>/<namespace>/<secret>" {
    capabilities = ["read","list"]
  }
  

Requirements

• Access to port 8500 of the Vault servers
  Vault is served over port 8500 so ensure you have access to that port on the Vault servers from whereever the vault binary/library will be run.
• Vault binary

Secret Maintainer

A Secret Maintainer is responsible for creating, updating, and deleting vault namespace policies. Vault policies are HCL documents that describe what parts of Vault a user is allowed to access.

Policies

• policy---write

  # ---------------------------------------------------------------------
  # policy-<namespace>-<secret>-write.hcl
  # ---------------------------------------------------------------------
  
  # Allow secret maintainer to CUD a secret
  path "<backend>/<namespace>/<secret>" {
    capabilities = ["create","update","delete"]
  }
  

Requirements

• Access to port 8500 of the Vault servers
  Vault is served over port 8500 so ensure you have access to that port on the Vault servers from whereever the vault binary/library will be run.
• Vault binary