lingrino / vaku

vaku extends the vault api & cli

Vaku

Vaku is a CLI and API for running path- and folder-based operations on the Vault Key/Value secrets engine. Vaku extends the existing Vault CLI and API by allowing you to run the same path-based list/read/write/delete functions on folders as well. Vaku also lets you search, copy, and move both secrets and folders.

Installation

Homebrew

brew install lingrino/tap/vaku

Scoop

scoop bucket add vaku https://github.com/lingrino/scoop-vaku.git
scoop install vaku

Docker

docker run ghcr.io/lingrino/vaku --help

Binary

Download the latest binary or deb/rpm for your os/arch from the releases page.

Usage

Vaku CLI documentation can be found on the command line using either vaku help [cmd] or vaku [cmd] --help. The same documentation is also available in markdown form in the docs/cli folder.

API

Documentation for the Vaku API is on pkg.go.dev.

Contributing

Suggestions and contributions of all kinds are welcome! If there is functionality you would like to see in Vaku please open an Issue or Pull Request and I will be sure to address it.

Tests

Vaku is well tested and uses only the standard go testing tools.

$ go test -cover -race ./...
ok  github.com/lingrino/vaku/v2      0.095s coverage: 100.0% of statements
ok  github.com/lingrino/vaku/v2/api 12.065s coverage: 100.0% of statements
ok  github.com/lingrino/vaku/v2/cmd  0.168s coverage: 100.0% of statements

vaku's Issues

Filter for Folder Copy to only copy based on Key Regex

I would like to be able to limit the results of the folder copy only to those whose key matches a particular regular expression.

use case

For the launch of TD, we needed to copy small subsets of common variables (e.g. RUBY_GC_MALLOC_MIN, RUBY_GC_MALLOC_MAX, etc.), and having regular expression selection of keys would have streamlined this work significantly.

Please add search example to docs

Hello! Thanks for vaku.
Please add search example to docs.

output with text is not sorted.

json output is sorted and always same.
But output with text is not sorted.

vaku folder read my-path/ -T -o text

Ability to pass paths on error

vaku version
API: 2.4.5
CLI: 2.4.5

Problem

vault list /foo
Keys
----
bar0/
bar1/
bar2/

if I have list permission to foo/bar0 and foo/bar2 but no list permission for foo/bar1, running the following command:
vaku folder search foo/ --absolute-path my_secret will fail with a 403 error on listing foo/bar1 and the process will be terminated before attempting foo/bar0 and foo/bar2.

would it be possible to add an option to vaku folder search to bypass the inaccessible folders? e.g.
vaku folder search foo/ --skip-error --absolute-path my_secret

For CMD like folder copy, VAULT_TOKEN or ~/.vault-token should not be mandatory

For folder copy from one namespace to another namespace.

VAULT_TOKEN or ~/.vault-token should not be mandatory as vaku will use source token and target token.

vaku folder copy $path/ $path/ --use-source-target-params --source-address=$source_address --source-token=$source_token --source-namespace=$source_namespace --target-address=$target_address --target-token=$target_token --target-namespace=$target_namespace -o=text

Cant use vaku without read capability on sys/mounts

I've run up against an issue where "normal" users cannot use most of the functionality in vaku since it relies on a call to https://github.com/lingrino/vaku/blob/main/api/mounts.go#L46 which requires read capability on sys/mounts.

We don't want to assign this capability to non-admin users as it would expose information/existence about mounts that the user does not have access to.

The only way I know of to get this information without using sys/mounts is through an internal endpoint used by the GUI which provides you with similar information, but scoped to the mounts that you have access. https://www.vaultproject.io/api-docs/system/internal-ui-mounts

That the endpoint is internal is a problem of course wrt stability and existence. I've written an issue on Vault for this but I don't have high hopes of a quick solution to it: hashicorp/vault#15724

The only way around this that I can think of is to make it possible to make the "mount source" pluggable to avoid requiring access to sys/mounts. In that way we could, for example, use the above internal endpoint at our own risk to get the information. Or some other static configuration available in our use case. Perhaps you have better ideas for how to tackle this?

Vaku (homebrew version) will not execute on Fedora Linux or WSL

Issue
After successfully installing linuxbrew, ensuring PATH is set correctly, installing vaku and setting /home/linuxbrew/.linuxbrew/Cellar/vaku/1.1.1/bin/vaku to be executable attempting to run vaku fails with the following error:

$ vaku -h
bash: /home/linuxbrew/.linuxbrew/bin/vaku: cannot execute binary file: Exec format error

Steps Taken
$ sh -c "$(curl -fsSL https://raw.githubusercontent.com/Linuxbrew/install/master/install.sh)"
$ test -d ~/.linuxbrew && eval $(~/.linuxbrew/bin/brew shellenv)
$ test -d /home/linuxbrew/.linuxbrew && eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv)
$ test -r ~/.bash_profile && echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.bash_profile
$ brew install lingrino/tap/vaku
$ vaku -h
bash: /home/linuxbrew/.linuxbrew/bin/vaku: Permission denied
$ chmod 555 /home/linuxbrew/.linuxbrew/Cellar/vaku/1.1.1/bin/vaku
$ vaku -h
bash: /home/linuxbrew/.linuxbrew/bin/vaku: cannot execute binary file: Exec format error

Additional Info
The vault binary included with the homebrew version of vaku executes without issue.
$ vault -h
Usage: vault <command> [args]
<snip>

file /home/linuxbrew/.linuxbrew/Cellar/vault/1.2.2/bin/vault
/home/linuxbrew/.linuxbrew/Cellar/vault/1.2.2/bin/vault: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, Go BuildID=SO1z1SDfi0jHi9Es0U-L/loeYoDLiiRizqE3Ftg_h/9pGJhh4sewGN5N0Hnyjp/KJ4ke0EOnHGwhY6QVTx8, not stripped

$ file /home/linuxbrew/.linuxbrew/Cellar/vaku/1.1.1/bin/vaku
/home/linuxbrew/.linuxbrew/Cellar/vaku/1.1.1/bin/vaku: Mach-O 64-bit x86_64 executable

** System Info**
This issue has presented on Fedora 30 and in the Pengwin (Debian) WSL distribution.

$ uname -a
Linux hostname 4.4.0-18362-Microsoft #1-Microsoft Mon Mar 18 12:02:00 PST 2019 x86_64 GNU/Linux

$ uname -a
Linux hostname.domain.local 5.2.8-200.fc30.x86_64 #1 SMP Sat Aug 10 13:21:39 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Add update with Compare and Swap (CAS)

First of all: Thanks for a very nice and useful library!

Question:
Did you consider adding CAS to the update operations (like this one: https://github.com/lingrino/vaku/blob/v2.5.0/api/path_update.go#L13)?

It would help in making it race free.

unable to install via brew

command used to install:
brew install lingrino/tap/vaku

got error message:

Error: Invalid formula: /usr/local/Homebrew/Library/Taps/lingrino/homebrew-tap/Formula/hoo.rb
hoo: Calling bottle :unneeded is disabled! There is no replacement.
Please report this issue to the lingrino/tap tap (not Homebrew/brew or Homebrew/core):
/usr/local/Homebrew/Library/Taps/lingrino/homebrew-tap/Formula/hoo.rb:6

Error: Cannot tap lingrino/tap: invalid syntax in tap!

OS: OS X Big Sur 11.6.4

Are you interested in integrating some logging capabilities?

Thanks for your work on vaku, I have been using it for a while and it has been a great help.

One problem I am having is that it is currently not possible to see what is the current progress and what is vaku actually doing; therefore, I was thinking of integrating some logging capabilities to it with a verbose mode. I have two questions about this:

• would you be willing to merge if I came up with such a PR or is this something you are not interested in adding to vaku?
• if yes, would you have any preference for a logging library?