This tool allow us to manage role secret_id. It delivers a secret_id the first time a VM or a container is launched. Each container or VM has a specific role, as such for each secret_id we add the hostname as a metadata to easily identify if a secret has been issued for this specific hostname. When we remove the VM or container, we can easily remove the secret_id.
It uses 2 differents auth method : approle or token based. I usually use the approle method if this script is intend to be run automatically (create policy only), and token based if I want to run it manually with an admin scoped token..
You have a running Vault installation, with installed policies and roles.
Here, for example, I'll use the role my-role, and I 'll use an admin token given with vault login -method=ldap username=fred.
pip3 install -r requirements.txtlocated in /etc/vault/config.yaml and containing the following :
url: https://vault.service.consul:8200
role_id: 00000000-0000-0000-0000-000000000001
secret_id: 00000000-0000-0000-0000-000000000002These settings could be overridden with env variables if you want to use an existing token :
export VAULT_TOKEN=00000000-0000-0000-0000-000000000003
export VAULT_URL=https://vault.service:8200usage: vault-approle-helper.py [-h] [-k]
role_name {list,delete,create,delete_from_secret} ...
Vault Approle Helper
positional arguments:
role_name The role you want to act on
{list,delete,create,delete_from_secret}
optional arguments:
-h, --help show this help message and exit
-k Don't check SSL certificateCreate a new secret_id for a given role :
fred@mbp:~# ./vault-approle-helper.py -k my-role create test
60e18b79-71ce-afe2-070c-a5fc97b93a36Give a role name and add an action :
fred@mbp:~# ./vault-approle-helper.py -k my-role list
+----------+--------------------------------------+
| hostname | secret_id_accessor |
+----------+--------------------------------------+
| test | 45d5af5e-733a-092a-201d-3d8b601b347c |
+----------+--------------------------------------+If the role name doesn't exists, you'll get the list of existing roles.
fred@mbp:~# ./vault-approle-helper.py -k my-role-d list
Role my-role-d does not exist. Here the list :
+----------------------+
| role |
+----------------------+
| my-role |
+----------------------+Delete a secret_id for a given hostname :
fred@mbp:~# ./vault-approle-helper.py -k my-role delete test
{'ok': 'delete succeeded'}Delete a secret_id for a given secret_id_accessor :
fred@mbp:~# ./vault-approle-helper.py -k my-role delete_from_secret 45d5af5e-733a-092a-201d-3d8b601b347c
{'ok': 'delete succeeded'}