falcosuessgott / vops

A wrapper for the HashiCorp Vault CLI

Hi there 👋

Im Tom, DevOps Engineer in Berlin and interested in Linux, Go, Kubernetes and Open Source. Im based in Berlin/Germany.

👷 Check out what I'm currently working on

• FalcoSuessgott/comments - (today)
• FalcoSuessgott/hashicorp-vault-playground - Bootstrap a local Vault HA Cluster with many useful learning labs in under a minute using only terraform, docker & minikube! (today)
• FalcoSuessgott/vkv - vkv enables you to list, compare, import, document, backup & encrypt secrets from a HashiCorp Vault KV engine (1 day ago)

🌱 My latest projects

• FalcoSuessgott/comments -
• FalcoSuessgott/vault-kubernetes-kms - Encrypt Kubernetes Secrets using Hashicorp Vault as the KMS Provider
• FalcoSuessgott/hashicorp-vault-playground - Bootstrap a local Vault HA Cluster with many useful learning labs in under a minute using only terraform, docker & minikube!

🔭 Latest releases I've contributed to

• FalcoSuessgott/vault-kubernetes-kms (v0.0.5, 2 days ago) - Encrypt Kubernetes Secrets using Hashicorp Vault as the KMS Provider
• FalcoSuessgott/vkv (v0.6.2, 1 week ago) - vkv enables you to list, compare, import, document, backup & encrypt secrets from a HashiCorp Vault KV engine
• FalcoSuessgott/hashicorp-vault-playground (v1.13.0, 1 week ago) - Bootstrap a local Vault HA Cluster with many useful learning labs in under a minute using only terraform, docker & minikube!

🔨 My recent Pull Requests

• e2e testing on FalcoSuessgott/vault-kubernetes-kms (4 days ago)
• feat(kms): use vault-kms-plugin on FalcoSuessgott/hashicorp-vault-playground (1 week ago)
• fix(docker): use fqdn path for entrypoint on FalcoSuessgott/vault-kubernetes-kms (1 week ago)

Want your own self-generating profile page? Check out readme-scribe!

vops's Issues

create symlink for latest snapshot file

Todos

• validate input (shares, keys > 0)
• replication (DR, PR)
• add file comment to example config pointing to this repo
• Gitlab integration
• flag for silence for every command
• Snapshot restore flag latest
• Support directories with vops configs
• support gpg key for keyfile encryption
• bool flat for unsealing
• adhoc cmd
• define vops policy to use all commands
• Gitbook pages
• Prompt for keys if no file specified
• status list all cluster, rendered values and check token login command
• test auto unseal
• subcommand for backup & restore
• retry when unsealing
• snapshot restore
• ui subcommand
• improve global precheck command
• rekey write to file
• generate vhs tape with examples
• handle missing keyfile if not initialized or something
• use shares and keys for init and other cmds
• consider using rows instead of columns for cfg vali
• copy token command
• login command
• custom commands ? customCmds: show policies: operator login -f .... -> pass to vault cli
• validate config file input in preexec func for each command, write unit tests
• better readme (cfg file right, usage left)

panic during vops token

[ Token ]
reading vops.yaml

[ d-trust-vault-enterprise ]
copying token for cluster d-trust-vault-enterprise
panic: assignment to entry in nil map

goroutine 1 [running]:
github.com/FalcoSuessgott/vops/cmd.tokenCmd.func1(0xc0001f6900, {0x89ba94, 0x0, 0x0})
        /home/runner/work/vops/vops/cmd/token.go:29 +0x12c
github.com/spf13/cobra.(*Command).execute(0xc0001f6900, {0xc66930, 0x0, 0x0})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:916 +0x842
github.com/spf13/cobra.(*Command).ExecuteC(0xc0001a6f00)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1044 +0x3cd
github.com/spf13/cobra.(*Command).Execute(...)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:968
github.com/FalcoSuessgott/vops/cmd.Execute({0x938930, 0xc000159f70})
        /home/runner/work/vops/vops/cmd/root.go:77 +0x31
main.main()
        /home/runner/work/vops/vops/main.go:13 +0x27

Some questions regarding root-Token and daily business

Hi,

I stumbled over this tool and want to try it at scale. But:
We have policy to destroy the root-Token after initial configuration (is done through pipelines) and I want to use this tool as handy cli-helper.

So it would be helpful to be able to use the custom commands or the snapshot Policy with a token with enough permissions.
Probably I missed it and it is possible right now - if so just close this issue ;)

Markus

autounseal true not working at initialization