vault.md

$ export $VAULT_ADDR=https://10.0.0.1
backend "file" {
  path = "/var/lib/vault"
}
ui = true
disable_mlock = true
listener "tcp" {
  address     = "10.0.0.1:443"
  tls_cert_file = "/etc/certs/vault.crt"
  tls_key_file  =  "/etc/certs/vault.key"
  tls_disable   = 0
}
$ vault operator init -key-shares=3 -key-threshold=2
Unseal Key 1: 6gAO3lmAhIaHzDAdkK256g2B2Dpeqy+z4jqQCJBID3d8
Unseal Key 2: TO7DDRQXSPC3IQylPEBPjPGAGAGMzjEkjT/FL62m7UUd
Unseal Key 3: CYfEbt83jYsQFcSErHT4Y5NCsrEtfFUE6tjQZKfP632K

Initial Root Token: s.78MykQO2b5qcy03rtoNwmhr1

Vault initialized with 3 key shares and a key threshold of 2. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 2 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated master key. Without at least 2 key to
reconstruct the master key, Vault will remain permanently sealed!
$ vault login token=<root-or-app-token>
$ export VAULT_TOKEN token=<root-or-app-token>
$ vault login -method=ldap username=mazenovi
path "cri/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
$ vault policy write cri `/etc/vault/cri.hcl`
$ vault write auth/ldap/groups/cri policies=cri
$ vault token create -policy=cri
$ vault secrets list
$ vault kv list cri/
$ vault kv get cri/test
$ vault kv get -format=json cri/test
$ vault kv get -format=json cri/test | jq .data
$ vault kv get -format=json cri/test | jq .data.data.root
$ vault kv put cri/test password2=$(date | sha256sum)
$ vault kv patch cri/test password1=$(date | sha256sum)
$ vault delete cri/test