Class: PasswordVault::HashiCorpVault

Inherits:
Object
  • Object
show all
Includes:
MintLogger, MonitorMixin
Defined in:
src/mintpress-common/lib/mintpress-common/hashicorp.rb

Overview

Class to manage passwords in HashiCorp Vault

Properties (Read/Write)

Properties (Read Only)

Constant Summary

Constants included from MintLogger

MintLogger::DEBUG, MintLogger::ERROR, MintLogger::FATAL, MintLogger::INFO, MintLogger::UNKNOWN, MintLogger::VERBOSE, MintLogger::WARN

Instance Method Summary collapse

Methods included from MintLogger::Utils::Common

#boolean_val, #has_value?, #no_value?, #nvl, #path_as_symbol, #ruby_level_to_send

Constructor Details

#initialize(options = {}) ⇒ HashiCorpVault

Initializes a new instance of the class. Supports all options of the Vault Client gem. Refer https://github.com/hashicorp/vault-ruby/tree/master

Parameters:

  • options (Hash) (defaults to: {}) —
    the options to init.

Options Hash (options):

  • :address (String, nil) —
    The address for the Vault server. Can be alternatively set via environment variable VAULT_ADDR
  • :namespace (String, nil) —
    The namespace to scope all operations to (Vault Enterprise). The namespace must already exist. Can be alternatively set via environment variable VAULT_NAMESPACE
  • :auth_method (String, nil) —
    The method used for authentication. Supported values: 'token', 'userpass', 'ldap'. Can be alternatively set via environment variable VAULT_AUTH_METHOD
  • :token (String, nil) —
    The token used for authentication. Can be alternatively set via environment variable VAULT_TOKEN
  • :username (String, nil) —
    The username for userpass authentication. Can be alternatively set via environment variable VAULT_USERNAME
  • :password (String, nil) —
    The password for userpass authentication. Can be alternatively set via environment variable VAULT_PASSWORD
  • :mount_path (String, nil) —
    The path to the Vault mount (default: 'kv/data'). Can be alternatively set via environment variable VAULT_MOUNT_PATH
  • :use_mint_encryption (Boolean) —
    Flag indicating whether to double encrypt (default: true). Can be alternatively set via environment variable VAULT_USE_MINT_ENCRYPTION. If this value is set, Mint will store encrypted value in Vault that can only be decoded by Mint.

Raises:

  • (RuntimeError) —
    if an unsupported authentication method is provided.

Instance Method Details

#get_password(path, key, value = nil, override: false, length: nil, include_chars: nil, include_numbers: nil, include_symbols: nil, must_start_with_char: nil, symbols: nil, auto_create: nil) ⇒ String

Retrieves or generates a password from the specified path.

Parameters:

  • path (String) —
    The path where the password is stored or will be stored.
  • key (String) —
    The key under which the password is stored.
  • value (String, nil) (defaults to: nil) —
    The password value to be stored. If nil, a new password will be generated.
  • override (Boolean) (defaults to: false) —
    Flag indicating whether to override the existing password (default: false).
  • length (Integer) (defaults to: nil) —
    The length of the generated password (default: 14).
  • include_chars (Boolean) (defaults to: nil) —
    Flag indicating whether to include alphabetical characters in the generated password (default: true).
  • include_numbers (Boolean) (defaults to: nil) —
    Flag indicating whether to include numbers in the generated password (default: true).
  • include_symbols (Boolean) (defaults to: nil) —
    Flag indicating whether to include symbols in the generated password (default: true).
  • must_start_with_char (Boolean) (defaults to: nil) —
    Flag indicating whether the generated password must start with an alphabetical character (default: true).
  • symbols (String) (defaults to: nil) —
    The set of symbols to include in the generated password (default: '-#_^$%*').

Returns:

  • (String) —
    The retrieved or generated password.

#list_passwords(path, output_file: nil, id: nil, decrypt: false) ⇒ Hash

Exports the password tree under `path` to a Chef data bag JSON file. Produces the inverse of the migration upload tooling: the returned (and written) structure is { "id" => , "" => { "" => }, ... } where each asset_code is a child secret of `path` in Vault.

Parameters:

  • path (String) —
    Top-level tree to export, e.g. 'eng2'
  • output_file (String, nil) (defaults to: nil) —
    Path to write JSON to (default: ".json")
  • id (String, nil) (defaults to: nil) —
    The data bag id (default: File.basename(path))
  • decrypt (Boolean) (defaults to: false) —
    When true, values are Mint-decrypted to plaintext; when false (default) values are emitted as stored (encrypted AES2...).

Returns:

  • (Hash) —
    the assembled data bag

#remove_password(path, key: nil, delete_tree: false) ⇒ Object

Removes an entry from the Vault If the key exists, then only the key is removed and other keys re-written if the key does not exists, no action is taken if delete_tree is true, the entire tree of secrets under path is permanently destroyed (every secret and all of its versions/metadata, recursively).

Parameters:

  • path (String) —
    leading upto the key, e.g. mysecret/myenvironment
  • key (String) (defaults to: nil) —
    Key to delete, e.g. username
  • delete_tree (Boolean) (defaults to: false) —
    flag to permanently destroy the entire tree if key is nil