martezr / vault-plugin-auth-vsphere

HashiCorp Vault auth plugin for authenticating VMware vSphere VMs

HashiCorp Vault VMware vSphere Authentication Plugin

This is a standalone backend plugin for use with HashiCorp Vault. This plugin allows for VMware vSphere virtual machines (VMs) to authenticate with Vault. This plugin requires the vAuth platform to be deployed and configured.

Getting Started

This is a Vault plugin and is meant to work with Vault. This guide assumes you have already installed Vault and have a basic understanding of how Vault works.

To learn specifically about how plugins work, see documentation on Vault plugins.

Setup

Download the latest plugin binary from the Releases page on GitHub and move the plugin binary into Vault's configured plugin_directory.

mv vault-plugin-auth-vsphere /etc/vault/plugins/vault-plugin-auth-vsphere

Calculate the checksum of the plugin and register it in Vault's plugin catalog. It is highly recommended that you use the published checksums on the Release page to verify integrity.

export SHA256_SUM=$(shasum -a 256 "/opt/vault/plugins/vault-plugin-auth-vsphere" | cut -d' ' -f1)

vault write sys/plugins/catalog/auth/vsphere command="vault-plugin-auth-vsphere" sha_256="${SHA256_SUM}

Enable authentication with the plugin.

vault auth enable vsphere

Configure the vAuth URL

vault write auth/vsphere/config vauth_url="https://vauth.grt.local"

Create a role and assign a policy to the role

vault write auth/vsphere/role/webapp policies=webapp

Developing

If you wish to work on this plugin, you'll first need Go installed on your machine (version 1.13+ is required).

Compile the plugin binary for use with Vault

env GOOS=linux GOARCH=amd64 go build -o plugins/vault-plugin-auth-vsphere cmd/vault-plugin-auth-vsphere/main.go

Run HashiCorp Vault in dev mode with the plugin automatically loaded

vault server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8200 -dev-plugin-dir=./plugins

export VAULT_ADDR="http://127.0.0.1:8200"

Enable the vSphere authentication plugin

vault auth enable -path="vsphere" -plugin-name="vault-plugin-auth-vsphere" plugin

License

Author:	Martez Reed ([email protected])
Copyright:	Copyright (c) 2019 Green Reed Technology
License:	Apache License, Version 2.0

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.