Golang如何安全地管理云密钥 Golang集成Vault的完整实现路径

import (
    "github.com/hashicorp/vault/api"
    "log"
    "os"
)

func NewVaultClient() (*api.Client, error) {
    config := api.DefaultConfig()
    config.Address = os.Getenv("VAULT_ADDR") // Vault服务器地址

    client, err := api.NewClient(config)
    if err != nil {
        return nil, err
    }

    // 设置认证Token (例如，从环境变量读取)
    client.SetToken(os.Getenv("VAULT_TOKEN"))

    return client, nil
}

func AuthenticateAppRole(client *api.Client, roleID, secretID string) (string, error) {
    data := map[string]interface{}{
        "role_id":   roleID,
        "secret_id": secretID,
    }

    secret, err := client.Logical().Write("auth/approle/login", data)
    if err != nil {
        return "", err
    }

    if secret == nil || secret.Auth == nil {
        return "", err
    }

    return secret.Auth.ClientToken, nil
}

func ReadSecret(client *api.Client, path string) (map[string]interface{}, error) {
    secret, err := client.Logical().Read(path)
    if err != nil {
        return nil, err
    }

    if secret == nil || secret.Data == nil {
        return nil, err
    }

    return secret.Data, nil
}

func main() {
    client, err := NewVaultClient()
    if err != nil {
        log.Fatalf("无法创建Vault客户端: %v", err)
    }

    // 使用AppRole认证
    token, err := AuthenticateAppRole(client, os.Getenv("APPROLE_ROLE_ID"), os.Getenv("APPROLE_SECRET_ID"))
    if err != nil {
        log.Fatalf("AppRole认证失败: %v", err)
    }
    client.SetToken(token)

    // 读取密钥
    secret, err := ReadSecret(client, "secret/data/my-app")
    if err != nil {
        log.Fatalf("读取密钥失败: %v", err)
    }

    // 使用密钥
    dbPassword, ok := secret["password"].(string)
    if !ok {
        log.Fatal("密码类型错误")
    }
    log.Printf("数据库密码: %s", dbPassword)
}