在Hashicorp保险库中清理孤立的动态信用的过程是什么？
我正在使用 Hashicorp Vault 在多个数据库集群中生成动态信用。我们有一个稍微短暂的数据库集群，因此有时会从另一个数据库集群刷新它。该数据库集群将像其他数据库集群一样通过 Vault 动态信用连接。
当刷新此集群时，我有清理源系统备份带来的数据库用户的过程，但我不知道应该如何处理保管库清理。数据库配置将相同（相同的主机/用户），但 Vault 最近创建的所有现有数据库用户帐户将在刷新后消失，因此我不知道需要做什么来重置/清理该数据库的 Vault 。我正在使用的数据库系统（Redshift）似乎没有 DROP USER ... IF EXISTS 类型的语法，否则我会简单地在动态角色的 replication_statements 中使用它并让它自然循环那样。
所以我的主要问题是，如果数据库集群刷新或不再存在，如何重置或删除为 Vault 中的特定数据库集群创建的所有动态信用？
I am using Hashicorp Vault to generate dynamic creds in multiple database clusters. We have one database cluster that is somewhat ephemeral so on occasion it will be refreshed from another database cluster. This database cluster will be connected to via Vault dynamic creds just like the other database clusters.
I have the process to clean up the database users brought over by the backup from the source system when this cluster is refreshed but I don't know how I should handle the Vault cleanup. The database config will be the same (same host/user) but all the existing database user accounts recently created by Vault will be gone after the refresh so I don't know what I need to do to reset/clean up Vault for that database. The database system I'm using (Redshift) doesn't seem to have DROP USER ... IF EXISTS type of syntax otherwise I would simply use that in the dynamic role's revocation_statements and let it cycle out naturally that way.
So my main question is how do I reset or delete all the dynamic creds that were created for a specific database cluster in Vault if the database cluster is refreshed or no longer exists?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我想出了这个答案，我想在这里分享，以防其他人遇到这一点。
“ nofollow noreferrer”>“租赁撤销”文档> -prefix 切换以基于部分或完整前缀匹配的撤销租赁。
使用此信息，您可以运行类似于以下命令的命令，以强制撤销特定角色的现有租赁：
保险库租赁撤销-force -prefix数据库/creds/creds/prole_name使用
-force开关即使revocation_statements未能处理（当数据库用户不再存在时）。并且在所有租赁之前和之后都非常有用。
顺便说一句，以下命令可用于列出租赁， 代码>
这解决了我的问题，即“我如何删除孤儿保管库动态凭据”的问题，如果从备份中刷新目标数据库的情况下，我正在为此使用此问题。
I figured out the answer to this and I wanted to share here in case anyone else encounters this.
The "lease revoke" documentation explains that you can use the
-prefixswitch to revoke leases based on a partial or full prefix match.Using this information you can run a command similar to the following in order to force revoke existing leases for a specific role:
vault lease revoke -force -prefix database/creds/ROLE_NAMEUsing the
-forceswitch will remove the lease even if therevocation_statementsfails to process (case when the database user no longer exists).As an aside, the following command can be used to list leases and is useful to check before and after that all the leases are, in fact, revoked:
vault list sys/leases/lookup/database/creds/ROLE_NAMEThis solves my problem of "how to I remove leases for orphaned Vault dynamic credentials" in cases where the target database is refreshed from a backup which is the case I am using this for.