vault-secrets-shuffle

configuration
usage
compatibility
build
notes

Fetches nodes definitions from PuppetDB, generate random secrets for each host and store them to Vault.

It is meant to be used in conjunction with hiera_vault

configuration

you have:

a kv v2 store on Vault
puppet Hiera connected to Vault through hiera_vault and your lookups include certnames/fqdn
a configuration file with one vault section as following (beware of file permissions):

[vault]
# Vault parameters
vault_token = xxxxxxxxxxx
vault_ssl = true
vault_host = vault.yourdomain.org
vault_port = 443
vault_path = test/toast
vault_keyname = vault_root_password

# PuppetDB parameters
puppetdb_host = puppetdb.yourdomain.org
puppetdb_port = 8080

# Password properties
pass_lenght = 10
min_digits = 2
max_digits = 6
min_symbols = 0
max_symbols = 0

usage

you can run the tool with --help to check all options:

vault-secrets-shuffle --help
Vault Secrets Shuffler:
  - iterates all VMs registered in PuppetDB
  - generate generate random secrets different for each host
  - upload the secrets to vault.

Usage:
  vault-secrets-shuffle --config=CONFIG [--kv=kv] [--write=WRITE] [--debug]
  vault-secrets-shuffle -v | --version
  vault-secrets-shuffle -b | --build
  vault-secrets-shuffle -h | --help

Options:
  -h --help           Show this screen
  -c --config=CONFIG  Config file
  -w --write=WRITE    Output file (OPTIONAL)
  -k --kv=kv          Keystore Version. [default: 2]
  -d --debug          Print password and full key path (OPTIONAL)
  -v --version        Print version exit
  -b --build          Print version and build information and exit

or you can simply run:

vault-secrets-shuffle --config /path/to/file.conf

compatibility

tested against:

puppetdb 6.2
vault 1.0.2

build

you can use build.sh from this repo

notes

Some change is already in the work on petems/petems-hiera_vault#43

These changes will allow to use Kv v2, which is safer to use (as it has password history)