ukhomeoffice / vaultconf

Configures vault with a given list of policies and users

Vaultconf

A command line tool to allow mass configuration updates in vault with support included for kubernetes. Functions include:

• update of policies in vault
• update of users in Vault

For more context please see this blog post.

Installation

This tool has not yet been setup as a Ruby gem, though it would be easy to do so. Instead we recommend running using docker to ensure no dependency issues:

e.g. docker run --net=host -v policies:/policies -ti quay.io/ukhomeofficedigital/vaultconf policies -c /policies -u user -p password -a http://localhost:8200 --nokube NB: In this example --net=host is needed as we are accessing a local vault server. This is not required for accessing remote vault servers.

Usage

Run with option --help to show command line help.

Example usage is included in vaultconf.feature. Example policies directory structure is provided in test/resources/policies. Example users yaml structure is provided in test/resources/users/users/yaml

In order to not need to define password in the command line vaultconf can read login details from a file called "login" in the .vaultconf directory in your home directory. The format for this file is as follows:

---
username: myusername
password: mypassword

Development

After checking out the repo, run bin/setup to install dependencies. Then, run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release to create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Contributing

1. Fork it ( https://github.com/UKHomeOffice/vaultconf/fork )
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create a new Pull Request

vaultconf's Issues

Should compare between configuration files and what exists

Currently:

• if a resource is removed from config files it won't be removed from vault when the tool is run
• if an already existing user is updated it will also generate a new password for them

Instead we should have:

• Comparison of existing entities in vault and entities in the config is made, and reconciled
• If a user already exists instead of replacing them it should just update their policies but leave them with the same password

Password should not be provided via cmd line argument

In general, doing so places the password in user's shell history.

Alternatives:

• dot config file
• env variable
• prompt for a password

command line options

• can we have vault address default to VAULT_ADDR
• the password masked and read from stdin

Missing a travis ci config

Make life easier for people submitting code to your repository. Make sure that you double check that their code works the best you can (even if that's just running a build of the package) in travis. This way potential contributors can fix bugs before you even need to look at their request. https://gist.github.com/PurpleBooth/6f1ba788bf70fb501439

Documentation: Use-cases

I would be interested to see a couple of lines in the README with what use-cases this project was designed to solve.

Context: I came across it whilst looking for a way to import/export secrets to/from Vault. It looks like it could be used for that purpose, however the Kubernetes integration made me wonder what it was initially for.

Enable features to run in docker

Currently travis can't run cucumber tests as they require a vault server to be started. Dockerising the tests would allow them to be run with travis

secrets management

Could we have the secrets, aws policys etc manageable from the same tool