Functions to interact with Hashicorp Vault.
maintainer: | SaltStack |
---|---|
maturity: | new |
platform: | all |
note: | If you see the following error, you'll need to upgrade requests to atleast 2.4.2 |
<timestamp> [salt.pillar][CRITICAL][14337] Pillar render error: Failed to load ext_pillar vault: {'error': "request() got an unexpected keyword argument 'json'"}
configuration: | The salt-master must be configured to allow peer-runner configuration, as well as configuration for the module. Add this segment to the master configuration file, or /etc/salt/master.d/vault.conf: vault:
url: https://vault.service.domain:8200
verify: /etc/ssl/certs/ca-certificates.crt
role_name: minion_role
auth:
method: approle
role_id: 11111111-2222-3333-4444-1111111111111
secret_id: 11111111-1111-1111-1111-1111111111111
policies:
- saltstack/minions
- saltstack/minion/{minion}
.. more policies
keys:
- n63/TbrQuL3xaIW7ZZpuXj/tIfnK1/MbVxO4vT3wYD2A
- S9OwCvMRhErEA4NVVELYBs6w/Me6+urgUr24xGK44Uy3
- F1j4b7JKq850NS6Kboiy5laJ0xY8dWJvB3fcwA+SraYl
- 1cYtvjKJNDVam9c7HNqJUfINk4PYyAXIpjkpN/sIuzPv
- 3pPK5X6vGtwLhNOFv1U2elahECz3HpRUfNXJFYLw6lid
Add this segment to the master configuration file, or /etc/salt/master.d/peer_run.conf: peer_run:
.*:
- vault.generate_token
|
---|
salt.modules.vault.
delete_secret
(path)¶Delete secret at the path in vault. The vault policy used must allow this.
CLI Example:
salt '*' vault.delete_secret "secret/my/secret"
salt.modules.vault.
list_secrets
(path)¶List secret keys at the path in vault. The vault policy used must allow this. The path should end with a trailing slash.
CLI Example:
salt '*' vault.list_secrets "secret/my/"
salt.modules.vault.
read_secret
(path, key=None)¶Return the value of key at path in vault, or entire secret
Jinja Example:
my-secret: {{ salt['vault'].read_secret('secret/my/secret', 'some-key') }}
{% set supersecret = salt['vault'].read_secret('secret/my/secret') %}
secrets:
first: {{ supersecret.first }}
second: {{ supersecret.second }}
salt.modules.vault.
write_raw
(path, raw)¶Set raw data at the path in vault. The vault policy used must allow this.
CLI Example:
salt '*' vault.write_raw "secret/my/secret" '{"user":"foo","password": "bar"}'
salt.modules.vault.
write_secret
(path, **kwargs)¶Set secret at the path in vault. The vault policy used must allow this.
CLI Example:
salt '*' vault.write_secret "secret/my/secret" user="foo" password="bar"
Docs for previous releases are available on readthedocs.org.
Latest Salt release: 2019.2.1