What now? When writing a 12 Factor app, its suggested that you configure everything with environment variables, including passwords, and other sensitive data. This sensitive data shouldn't be on disk, and luckily, it doesn't have to be; it can be stored in Vault.
$ cat .env
HOME="${HOME}"
PASSWORD="${vault:///v1/secret/data/user#data.data.password}"
USERNAME="${vault:///v1/secret/data/user#data.data.user}"
INTERVIEW="Interviewer: Hello, ${USER}! Thanks for joining me.
${USER}: My pleasure!
Interviewer: You wrote this utility to show off an intuitive way to do
12 Factor with Vault, is that correct?
${USER}: Why yes it is, Bob. Yes it is."
# What's the PASSWORD?
$ envbreach python -c "import os; print os.environ['PASSWORD']"
hunter2
# Now show what the full environment is when running.
$ envbreach env
HOME=/home/apg
PASSWORD=hunter2
USERNAME=apg
INTERVIEW=Interviewer: Hello, apg! Thanks for joining me.
apg: My pleasure!
Interviewer: You wrote this utility to show off an intuitive way to do
12 Factor with Vault, is that correct?
apg: Why yes it is, Bob. Yes it is.
This assumes that the following is in envbreach's environment:
APPROLE_ROLE_PATH: Mount path for the approle engine. Or-a path.APPROLE_ROLE_ID: Role ID for the approle. Or-r role_id.APPROLE_SECRET_ID: Secret ID for the approle. Or-s secret_id. Note that this does not support response wrapped secrets at the moment.VAULT_ADDR: As normal. Or-addr vault_addr.VAULT_NAMESPACE: As normal. Or-namespace namespace.
An alternative file to .env is provided with -e envfile.
The envfile is the standard KEY=value Unix environment
variables. These can be quoted, and if they are quoted, can also be
multiline. Quotes within a quoted string can also be escaped via \".
The use of ${ ... } triggers substitution with the following rules:
${vault:///path/to/something#JSON.keys.to.select}: Using the
configured approle, login and read /path/to/something from
Vault. The JSON returned is then traversed as nested maps through the
keys [JSON, keys, to, select], and the final thing there is
stringified and substituted.
${ENV}: Expands to the environment variable $ENV for the purposes
of explicit export of envbreach's environment. In this way, you can
hide APPROLE_SECRET_ID as envbreach doesn't pass it on by default.
- Only basic approle support
- Code is a mess, but this is a Hack Week project
- No explicit way to escape
{or}in env values, so that might be surprising.
(c) 2022, Andrew Gwozdziewycz: web@apgwoz.com
See LICENSE file for more information.