CLI tool for Hashicorp Vault

This tools allows simple interactions with the vault API, allowing configuration to be done in a separate step using a YAML configuration file.

This is especially interesting if you interact with Hashicorp Vault from automated deployment tools

Installation

The tool is packaged but the package is not yet available on pypi.

pip install vault-cli

If you wish to use the hvac backend, install with

pip install vault-cli[hvac]

Usage

$ vault --help
Usage: vault [OPTIONS] COMMAND [ARGS]...

  Interact with a Vault. See subcommands for details.

Options:
  -U, --url TEXT                URL of the vault instance
  --verify / --no-verify        Verify HTTPS certificate
  -c, --certificate FILENAME    The certificate to connect to vault
  -t, --token TEXT              The token to connect to Vault
  -T, --token-file FILENAME     File which contains the token to connect to
                                Vault
  -u, --username TEXT           The username used for userpass authentication
  -w, --password-file FILENAME  Can read from stdin if "-" is used as
                                parameter
  -b, --base-path TEXT          Base path for requests
  --backend TEXT                Name of the backend to use (requests, hvac)
  -h, --help                    Show this message and exit.

Commands:
  delete   Deletes a single secret.
  get      Return a single secret value.
  get-all  Return multiple secrets.
  list     List all the secrets at the given path.
  set      Set a single secret to the given value(s).

Authentication

There are three ways to authenticate against the vault:

Username and password file: provide a username and a file to read the password from. The file may be - for stdin.
Certificate: provide the path to a certificate file. The file may also be read from stdin via -.
Token: Bypass authentication step if you already have a valid token.

Examples

# Connect to https://vault.mydomain:8200/project and list the secrets
$ vault --url=https://vault.mydomain:8200 --certificate=/etc/vault/certificate.key --base-path=project/ list
['mysecret']

# Using the configuration file, get the value for my_secret (yaml format)
$ vault get my_secret
--- qwerty
...

# Same with only the value of the secret in plain text
$ vault get my_secret --text
qwerty

# Add another secret
$ vault set my_other_secret supersecret
Done

# Add a secret object
$ vault set --yaml blob_secret "{code: supercode}"
Done

# Get all values from the vault in a single command (yaml format)
$ vault get-all
---
my_secret: qwerty
my_other_secret: supersecret
blob_secret:
  code: supercode
test:
  my_folder_secret: sesame

# Get a nested secret based on a path
$ vault get-all test/my_folder_secret
test:
  my_folder_secret: sesame

# Get all values from a folder in a single command (yaml format)
$ vault get-all test my_secret
---
my_secret: qwerty
test:
  my_folder_secret: sesame

# Delete a secret
$ vault delete my_other_secret
Done

Configuration

All files at the following location are read (in increasing priority order), parsed, merged and used:

/etc/vault.yml
~/.vault.yml
./.vault.yml

Any option passed as command line flag will be used over the corresponding option in the documentation.

The expected format of the configuration is a mapping, with option names and their corresponding values:

---
username: my_username
password-file: ~/.vault-password
# or
token-file: ~/.vault-token
url: https://vault.mydomain:8200
verify: no
base-path: project/
...

Just note that the --verify / --no-verify flag become verify: yes or verify: no

State

The tool is currently in beta mode. It's missing docs, tests, CI, and such. Be warned.

License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Development Status
- 4 - Beta
Intended Audience
- Developers
License
- OSI Approved :: Apache Software License
Programming Language

Release files for vault-cli 0.2.2

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for vault-cli 0.2.2
File	Size	Uploaded
vault-cli-0.2.2.tar.gz	7.7 kB	Sep 29, 2018	Details

Built distribution (wheel)

Table of built distributions (wheels) for vault-cli 0.2.2
File	Interpreter	ABI	Platform	Reset
vault_cli-0.2.2-py2.py3-none-any.whl 10.7 kB Sep 29, 2018	Python 3, Python 2	none	any	Details

Total release size: 18.4 kB

Release files / vault-cli-0.2.2.tar.gz

Download URL	vault-cli-0.2.2.tar.gz
Size	7.7 kB
Tags	Source
SHA-256 checksum How to use checksums	`216063659231c49cca92b706b1a603f8819cc09516cc378e7b2a9ab74bad3806`
BLAKE2b-256 checksum How to use checksums	`811f36488505b6fd478f89cb84e9c5932407a83e6061513b937fe003ae3efe98`
Upload date	Sep 29, 2018
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.12.1 pkginfo/1.4.2 requests/2.19.1 setuptools/40.4.3 requests-toolbelt/0.8.0 tqdm/4.26.0 CPython/3.7.0`

Release files / vault_cli-0.2.2-py2.py3-none-any.whl

Download URL	vault_cli-0.2.2-py2.py3-none-any.whl
Size	10.7 kB
Tags	Python 2 Python 3
SHA-256 checksum How to use checksums	`9409dab552016b2103820344c4f8567acf364608d1e90585afc5e6c3640b90b3`
BLAKE2b-256 checksum How to use checksums	`24e193eb7bb814a64d9860125afdb79a8ae156ae24b7b19da8652f80f4936df1`
Upload date	Sep 29, 2018
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.12.1 pkginfo/1.4.2 requests/2.19.1 setuptools/40.4.3 requests-toolbelt/0.8.0 tqdm/4.26.0 CPython/3.7.0`