teamsnap / vault-key

Easy Vault integration with GCP for Golang, NodeJS, and Ruby

Vault integration with GCP and GitHub for Golang, NodeJS, and Ruby

Vault-Key makes it easy to use Vault with the Google Cloud Auth Method. It uses a GCP service account and JSON web tokens to log in to Vault securely and without a password. Then it retrieves the secrets you need and makes them available in your code, hassle free.

This project also makes it easy to interact with Vault using Github Authentication. Interaction is not only limited to retrieval, pkg/vault allows you to manage secrets as well.

Usage

Golang

package main

import (
    "context"
    "fmt"
    "github.com/teamsnap/vault-key/pkg/vault"
)

var env = map[string]map[string]string{}

var envArr = []string{
    "secret-engine/data/secret-name",
    "secret-engine-2/data/another-secret-name",
}

func main() {
    ctx := context.Background()

    vault.GetSecrets(ctx, &env, envArr)

    fmt.Println("Secret values:", env)
    fmt.Println("secret-key value = " + env["secret-engine/data/secret-name"]["secret-key"])
    fmt.Println("secret-key-2 value = " + env["secret-engine-2/data/another-secret-name"]["secret-key-2"])
}

NodeJS

const vault = require('@teamsnap/vault-key')

const secrets = [
  'secret-engine/data/secret-name',
  'secret-engine-2/data/another-secret-name'
]

const secretData = vault.getSecrets(secrets)

console.log('Secret values:', JSON.stringify(secretData, null, 4))
console.log(`secret-key value = ${secretData['secret-engine/data/secret-name']['secret-key']}`)
console.log(`secret-key-2 value = ${secretData['secret-engine-2/data/another-secret-name']['secret-key-2']}`)

Ruby

require 'vault-key'

secrets = [
  "secret-engine/data/secret-name",
  "secret-engine-2/data/another-secret-name"
]

secretData = Vault.getSecrets(secrets)

puts secretData

puts secretsData["secret-engine/data/secret-name"]["secret-key"]
puts secretsData["secret-engine-2/data/another-secret-name"]["secret-key-2"]

Environment Variable Configuration

Environment Variable	Default	Required (GCP)	Required (other environments)	Example	Description
ENVIRONMENT	"development"	No	No	production	If set to anything but production, prints trace level logs
FUNCTION_IDENTITY	""	No	Yes	[email protected]	Email address associated with service account (Required for Google Authentication)
GITHUB_OAUTH_TOKEN	""	No	No	1234abcd	GitHub Personal Access Token (When set, disables Google Authentication)
GCLOUD_PROJECT	""	No	No	my-project-123	Project ID the service account belongs to
GOOGLE_APPLICATION_CREDENTIALS	""	No	No	service-account/my-project-123.serviceaccount.json	Path to service account credentials file
TRACE_ENABLED	"false"	No	No	true	Whether or to enable opencensus tracing
TRACE_PREFIX	"vault"	No	No	my-company	Prefix added to name of tracing spans
VAULT_ADDR	""	Yes	Yes	https://vault.my-company.com	Vault address including protocol
VAULT_ROLE	""	Yes	No	vault-role-cloud-functions	Name of role created in Vault for GCP auth. (Required for Google Auth)

GitHub Auth Method

This project also allows you to use GitHub Personal Access tokens for Vault. You'll need to configure a personal access token for a user configured with Vault access. Note that this authentication method is only enabled when the GITHUB_OAUTH_TOKEN environment variable is set. When not set, this project defaults to Google authentication method specified below.

Google Cloud Auth Method

Because this project uses the Google Cloud auth method for Vault, you'll need to configure a role for the service account you're using. By default, for Google Cloud Functions that will be <project-id>@appspot.gserviceaccount.com. You can use the Terraform example to get you started.

Kubernetes

Integrating Vault with Kubernetes is easy to do with this project.

There are examples of two different strategies.

1. Using an init container and a shared volume to write a secret to a .env file that your app can read in when it's container starts
2. Running a job or cronjob to sync Vault secrets with Kubernetes secrets that your deployments can read in like they would any other k8s secrets.

References

• Vault Google Cloud Auth
• node-8.16 v8 docs
• nodeaddons.com

vault-key's Issues

add description to readme

we need to better describe what the project is at the beginning of the readme

Calls to IAM SignBlob and SignJwt won’t be supported as of July 1, 2021

SignJwt is used in the auth flow to login to vault without a password here.

Starting July 1, 2021, your calls to SignBlob and SignJwt (also known as JSON Web Tokens (JWT)) on the IAM API will no longer be supported and may fail.

We are deprecating both authentication methods on: https://iam.googleapis.com
Instead, you can now use: https://iamcredentials.googleapis.com

You must migrate your projects off the IAM API to the new IAMCredentials API to avoid a service disruption. The IAMCredentials API supports higher traffic volumes across the network, giving you better access and reliability.

What do I need to know?
SignBlob and SignJwt are currently running and serving real-time traffic. You can migrate your projects at any time without a service disruption. Both methods have full replacements.

Notable syntactic and semantic differences between the old IAM API and the new IAMCredentials API include the following:

Request and response fields are slightly different.
New API doesn’t allow project-id in the resource name, and only allows a dash (-).
New API demands the expiration time (exp) field to be set in the JWT that is to be signed.
Review the migration guide and learn more about the differences between the old and new API.

What do I need to do?
Start using the new IAMCredentials API immediately. Follow these instructions to move your projects from the IAM API to the new IAMCredentials API before July 1, 2021.

pencil icon If you use IAM SignBlob/Jwt as a dependency of other Google libraries, refer to the client library section to see the current version as illustrated below for the Cloud Storage C++ library.



If you don’t pin your dependent authentication library version when another Google client library is upgraded, your project may start calling the IAMCredentials SignBlob/Jwt without your knowledge and you may experience service interruptions.
For authentication details, refer to the IAM Credentials SignBlob API and IAM Credentials SignJwt API documentation.

name change

@stevenaldinger to release this publicly, we need to come up with a better name. it may be as simple as vault_gcp_integration or vault4gcp or as silly as golden_citadel_protection. bottom line, we cannot release some called vault.

Question - Namespaces

Hey all, thanks for maintaining this package :) Was wondering if you have support for namespaces using node and gcp auth?