Functions to interact with Hashicorp Vault.
| maintainer: | SaltStack |
|---|---|
| maturity: | new |
| platform: | all |
| note: | If you see the following error, you'll need to upgrade requests to at least 2.4.2 |
<timestamp> [salt.pillar][CRITICAL][14337] Pillar render error: Failed to load ext_pillar vault: {'error': "request() got an unexpected keyword argument 'json'"}
| configuration: | The salt-master must be configured to allow peer-runner configuration, as well as configuration for the module. Add this segment to the master configuration file, or /etc/salt/master.d/vault.conf: vault:
url: https://vault.service.domain:8200
verify: /etc/ssl/certs/ca-certificates.crt
role_name: minion_role
namespace: vault_enterprice_namespace
auth:
method: approle
role_id: 11111111-2222-3333-4444-1111111111111
secret_id: 11111111-1111-1111-1111-1111111111111
policies:
- saltstack/minions
- saltstack/minion/{minion}
.. more policies
keys:
- n63/TbrQuL3xaIW7ZZpuXj/tIfnK1/MbVxO4vT3wYD2A
- S9OwCvMRhErEA4NVVELYBs6w/Me6+urgUr24xGK44Uy3
- F1j4b7JKq850NS6Kboiy5laJ0xY8dWJvB3fcwA+SraYl
- 1cYtvjKJNDVam9c7HNqJUfINk4PYyAXIpjkpN/sIuzPv
- 3pPK5X6vGtwLhNOFv1U2elahECz3HpRUfNXJFYLw6lid
Add this segment to the master configuration file, or /etc/salt/master.d/peer_run.conf: peer_run:
.*:
- vault.generate_token
|
|---|
salt.modules.vault.clear_token_cache()¶Changed in version 3001.
Delete minion Vault token cache file
CLI Example:
salt '*' vault.clear_token_cache
salt.modules.vault.delete_secret(path)¶Delete secret at the path in vault. The vault policy used must allow this.
CLI Example:
salt '*' vault.delete_secret "secret/my/secret"
salt.modules.vault.destroy_secret(path, *args)¶New in version 3001.
Destroy specified secret version at the path in vault. The vault policy used must allow this. Only supported on Vault KV version 2
CLI Example:
salt '*' vault.destroy_secret "secret/my/secret" 1 2
salt.modules.vault.list_secrets(path, default=<class 'salt.exceptions.CommandExecutionError'>)¶Changed in version 3001: The default argument has been added. When the path or path/key
combination is not found, an exception will be raised, unless a default
is provided.
List secret keys at the path in vault. The vault policy used must allow this. The path should end with a trailing slash.
CLI Example:
salt '*' vault.list_secrets "secret/my/"
salt.modules.vault.read_secret(path, key=None, metadata=False, default=<class 'salt.exceptions.CommandExecutionError'>)¶Changed in version 3001: The default argument has been added. When the path or path/key
combination is not found, an exception will be raised, unless a default
is provided.
Return the value of key at path in vault, or entire secret
| Parameters: | metadata -- Optional - If using KV v2 backend, display full results, including metadata New in version 3001. |
|---|
Jinja Example:
my-secret: {{ salt['vault'].read_secret('secret/my/secret', 'some-key') }}
{{ salt['vault'].read_secret('/secret/my/secret', 'some-key', metadata=True)['data'] }}
{% set supersecret = salt['vault'].read_secret('secret/my/secret') %}
secrets:
first: {{ supersecret.first }}
second: {{ supersecret.second }}
salt.modules.vault.write_raw(path, raw)¶Set raw data at the path in vault. The vault policy used must allow this.
CLI Example:
salt '*' vault.write_raw "secret/my/secret" '{"user":"foo","password": "bar"}'
salt.modules.vault.write_secret(path, **kwargs)¶Set secret at the path in vault. The vault policy used must allow this.
CLI Example:
salt '*' vault.write_secret "secret/my/secret" user="foo" password="bar"
Docs for previous releases are available on readthedocs.org.
Latest Salt release: 3004.1