Como configurar o mecanismo de segredos KMIP do HashiCorp Vault com MongoDB CSFLE ou Queryable Encryption

1
git clone https://github.com/mongodb-developer/mongodb-kmip-fle-queryable

1
encrypted_namespace = "DEMO-KMIP-FLE.users"
2
key_vault_namespace = "DEMO-KMIP-FLE.datakeys"
3
connection_uri = "mongodb+srv://<USER>:<PASSWORD>@<CLUSTER-NAME>?retryWrites=true&w=majority"
4
# Configure the "kmip" provider.
5
kms_providers = {
6
   "kmip": {
7
       "endpoint": "localhost:5697"
8
   }
9
}
10
kms_tls_options = {
11
   "kmip": {
12
       "tlsCAFile": "vault/certs/FLE/vv-ca.pem",
13
       "tlsCertificateKeyFile": "vault/certs/FLE/vv-client.pem"
14
   }
15
}

1
encrypted_namespace = "DEMO-KMIP-FLE.users"
2
key_vault_namespace = "DEMO-KMIP-FLE.datakeys"
3
connection_uri = "mongodb+srv://admin:mPassword@demo-cluster.tcrpd.mongodb.net/myFirstDatabase?retryWrites=true&w=majority"
4
# Configure the "kmip" provider.
5
kms_providers = {
6
   "kmip": {
7
       "endpoint": "localhost:5697"
8
   }
9
}
10
kms_tls_options = {
11
   "kmip": {
12
       "tlsCAFile": "vault/certs/FLE/vv-ca.pem",
13
       "tlsCertificateKeyFile": "vault/certs/FLE/vv-client.pem"
14
   }
15
}

1
encrypted_namespace = "DEMO-KMIP-QUERYABLE.users"
2
key_vault_namespace = "DEMO-KMIP-QUERYABLE.datakeys"
3
connection_uri = "mongodb+srv://admin:mPassword@demo-cluster.tcrpd.mongodb.net/myFirstDatabase?retryWrites=true&w=majority"
4
5
# Configure the "kmip" provider.
6
kms_providers = {
7
   "kmip": {
8
       "endpoint": "localhost:5697"
9
   }
10
}
11
kms_tls_options = {
12
   "kmip": {
13
       "tlsCAFile": "vault/certs/QUERYABLE/vv-ca.pem",
14
       "tlsCertificateKeyFile": "vault/certs/QUERYABLE/vv-client.pem"
15
   }
16
}

1
docker run -p 8200:8200 -it -v ${PWD}:/kmip piepet/mongodb-kmip-vault:latest

1
cd kmip 
2
./start_and_configure_vault.sh -a

1
def main():
2
   reset()
3
   #1,2 Configure your KMIP Provider and Certificates
4
   kmip_provider_config = configure_kmip_provider()
5
   #3 Configure Encryption Data Keys
6
   data_keys_config = configure_data_keys(kmip_provider_config)
7
   #4 Create collection with Validation Schema for CSFLE defined, will be stored in
8
   create_collection_with_schema_validation(data_keys_config)
9
   #5 Configure Encrypted Client
10
   secure_client=configure_csfle_session()
11
   #6 Run Query
12
   create_user(secure_client)
13
if __name__ == "__main__":
14
   main()

1
cd /kmip/kmip-with-hashicorp-key-vault/ 
2
python3.8 vault_encrypt_with_csfle_kmip.py

1
def main():
2
   reset()
3
   #1,2 Configure your KMIP Provider and Certificates
4
   kmip_provider_config = configure_kmip_provider()
5
   #3 Configure Encryption Data Keys
6
   data_keys_config = configure_data_keys(kmip_provider_config)
7
   #4 Create Schema for Queryable Encryption, will be stored in database
8
   encrypted_fields_map = create_schema(data_keys_config)
9
   #5 Configure Encrypted Client
10
   secure_client = configure_queryable_session(encrypted_fields_map)
11
   #6 Run Query
12
   create_user(secure_client)
13
if __name__ == "__main__":
14
   main()

1
cd /kmip/kmip-with-hashicorp-key-vault/ 
2
python3.8 vault_encrypt_with_queryable_kmip.py

1
./cleanup.sh