Resources and access

examples/go-service/compose.yml

@@ -10,6 +10,7 @@ services:
       VAULT_KV_MOUNT: ${VAULT_MOUNT:-secrets}
       VAULT_DB_MOUNT: ${VAULT_DATABASE_MOUNT:-database}
       SERVICE_NAME: ${SERVICE_NAME:-}
+      DATABASE_NAME: ${DATABASE_NAME:-}
       POSTGRES_CREDS: ${POSTGRES_CREDS:-static}
     ports:
       - "127.0.0.1:${EXAMPLE_PORT:-8090}:8080"

examples/go-service/main.go

@@ -21,6 +21,7 @@ import (
 func main() {
 	ctx := context.Background()
 	service := mustEnv("SERVICE_NAME")
+	database := mustEnv("DATABASE_NAME")
 	kvMount := mustEnv("VAULT_KV_MOUNT")
 
 	client, err := vault.NewClient(vault.DefaultConfig())
@@ -34,12 +35,12 @@ func main() {
 	kv := client.KVv2(kvMount)
 	s3Secret, err := kv.Get(ctx, service+"/s3")
 	check(err, "секрет s3")
-	pgSecret, err := kv.Get(ctx, service+"/postgres")
+	pgSecret, err := kv.Get(ctx, service+"/postgres/"+database)
 	check(err, "секрет postgres")
 
 	pgUser, pgPassword := str(pgSecret.Data, "username"), str(pgSecret.Data, "password")
 	if os.Getenv("POSTGRES_CREDS") == "dynamic" {
-		creds, err := client.Logical().ReadWithContext(ctx, mustEnv("VAULT_DB_MOUNT")+"/creds/"+service)
+		creds, err := client.Logical().ReadWithContext(ctx, mustEnv("VAULT_DB_MOUNT")+"/creds/"+service+"-"+database)
 		check(err, "временные учётные данные")
 		pgUser, pgPassword = str(creds.Data, "username"), str(creds.Data, "password")
 		log.Printf("postgres: временная роль %s на %dс", pgUser, creds.LeaseDuration)