ripple / salt-pillar-vault

Saltstack external pillar for Hashicorp Vault with flexible minion targeting

salt-pillar-vault

Saltstack external pillar for Hashicorp Vault with flexible minion targeting

Requirements

• hvac python module (>= v0.2.17)

Example Configuration

Your Vault server should be defined in the master config file with the following options:

    ext_pillar:
      - vault:
          url: https://vault:8200
          config: Path or salt:// URL to vault secret configuration
          token: (optional) Explicit token for token authentication
          app_id: (optional) Application ID for app-id authentication
          user_id: (optional) Explicit User ID for app-id authentication
          user_file: (optional) File to read for user-id value
          role_id: (optional) Role ID for AppRole authentication
          secret_id: (optional) Explicit Secret ID for AppRole authentication
          secret_file: (optional) File to read for secret-id value
          unset_if_missing: (optional) Leave pillar key unset if Vault secret not found

The url parameter is the full URL to the Vault API endpoint.

The config parameter is the path or salt:// URL to the secret map YML file to be parsed by the master.

The token parameter is an explicit token to use for authentication, and it overrides all other authentication methods.

The app_id parameter is an Application ID to use for app-id authentication.

The user_id parameter is an explicit User ID to pair with app_id for app-id authentication.

The user_file parameter is the path to a file on the master to read for a user-id value if user_id is not specified.

The role_id parameter is a Role ID to use for AppRole authentication.

The secret_id parameter is an explicit Role ID to pair with role_id for AppRole authentication.

The secret_file parameter is the path to a file on the master to read for a secret-id value if secret_id is not specified.

The unset_if_missing parameter determines behavior when the Vault secret is missing or otherwise inaccessible. If set to True, the pillar key is left unset. If set to False, the pillar key is set to None. Default is False

Mapping Vault Secrets to Minions

The config parameter, above, is a path to the YML file which will be used for mapping secrets to minions. The map uses syntax similar to the top file, and will be processed as a Jinja template:

    'filter':
      'variable': 'path'
      'variable': 'path?key'
    'filter':
      'variable': 'path?key'

Each filter is a compound matcher: https://docs.saltstack.com/en/latest/topics/targeting/compound.html

variable is the name of the variable which will be injected into the pillar data.

path is the path the desired secret on the Vault server.

key is optional. If specified, only this specific key will be returned for the secret at path. If unspecified, the entire secret json structure will be returned.

    'web*':
      'ssl_cert': '/secret/certs/domain?certificate'
      'ssl_key': '/secret/certs/domain?private_key'
    'db* and [email protected]':
      'db_pass': '/secret/passwords/database'
    '*':
      'my_key': '/secret/certs/{{ grains.id }}?private_key'

Authors

• Derek Moore - Author

salt-pillar-vault's Issues

NoneType error

hi there -

wondering if you could help out really quick?

when i refresh my pillar data, the salt master log prints out:

[salt.pillar ][CRITICAL][13818] Pillar render error: Failed to load ext_pillar vault_store: 'NoneType' object has no attribute '__getitem__'

I'm pretty sure i've got the configuration right, here it is:

`ext_pillar:

• vault_store:
  url: https://vault.url:8200
  config: /etc/salt/config.yml
  token: redacted
  unset_if_missing: True`

here is my config yaml

'*': 'aws_key_id': 'secret/service/salt/dev/aws-access-key?id' 'aws_secret_key': 'secret/service/salt/dev/aws-secret-access-key?secret'

i've made sure that the token can read and write to that path in Vault and that the salt master can reach the vault server.

Not too sure what to do at this point.

Add AWS Auth backend support

Would be awesome to have this solution to use the Vault AWS Auth backend. This way we wouldn't need to have any credentials sitting into config files for the Salt Master to be able to talk to Vault.

For more info Vault AWS Backend Docs

Loading Vault secrets into non-top-level Pillar keys

Elsewhere, I might have a Salt formula that expects an X.509 key pair stored in Pillar keys that aren't at the top level:

foobar-app:
  pubkey: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
  privkey: |
    -----BEGIN PRIVATE KEY-----
    ...
    -----END PRIVATE KEY-----

Is it possible to tell salt-pillar-vault to load the above key-pair from Vault and put it into foobar-app:pubkey and foobar-app:privkey (which I would assume gets merged with other Pillar data sources in the usual way)? If not, is that what #1 will add?

running with a masterless minion?

Another issue :-)

Trying to run the plugin in vagrant with a masterless minion, but there seems to be a problem with the minion matching

2016-11-17 21:23:04,842 [salt.template    ][DEBUG   ][31381] Rendered data from file: /vagrant/salt/srv/salt/common/vault-config.yml:
'amperity-vbox':
  'vault':
    'aws_key_id': 'secret/service/salt/vagrant/aws-access-key?id'
    'aws_secret_key': 'secret/service/salt/vagrant/aws-access-key?secret'

2016-11-17 21:23:04,843 [salt.utils.minions][DEBUG   ][31381] _check_compound_minions(amperity-vbox, :, True, False)
2016-11-17 21:23:04,843 [salt.utils.minions][ERROR   ][31381] Failed matching available minions with compound pattern: amperity-vbox

I've tried other standard patterns for compound matching even '*', but nothing seems to work.

the newest version of salt takes a min of 5 args for compile_template

https://github.com/saltstack/salt/blob/2016.11/salt/template.py#L30-L34

        - Failed to load ext_pillar vault: compile_template() takes at least 5 arguments (3 given)

Dict as key

It seems you can't use a dict as a key with current version, it gives the following error.

Failed to load ext_pillar vault: 'dict' object has no attribute 'startswith'

Is this a bug or am I doing it wrong?