CLI that provides on-demand secrets access for common DevOps tools
Go Shell Gherkin Ruby Makefile
Clone or download
sgnn7 and dividedmind Fixed escaping of godep path in README
Since backticks are used to escape the code block,
the repeated backtick removes the formatting. Fixed the doc by
removing the backticks and using the generally more accepted
way of grabbing the output of a command with `$()`.
Latest commit 0a752fd May 22, 2018
Permalink
Failed to load latest commit information.
Godeps fix: replace conjurinc with cyberark + move github pages from branch … Aug 23, 2017
acceptance Fix cucumber with the newline Feb 10, 2016
bin Added check for `sudo` (#69) May 10, 2018
command summon no longer buffers wrapped process stdout output [CONJ-4705] (#64) Feb 6, 2018
docs Add AWS Secrets Manager to the list of providers Apr 4, 2018
provider fix: replace conjurinc with cyberark + move github pages from branch … Aug 23, 2017
script Adds copyright info Jun 23, 2015
secretsyml fix: replace conjurinc with cyberark + move github pages from branch … Aug 23, 2017
vendor 'context' is a test dependency Jun 20, 2016
.dockerignore clean: remove redundant junit from .dockerignore Aug 1, 2017
.gitignore built/ -> output/ Jul 31, 2017
.kateconfig Add kate editor config May 22, 2015
CHANGELOG.md summon no longer buffers wrapped process stdout output [CONJ-4705] (#64) Feb 6, 2018
Dockerfile fix: replace conjurinc with cyberark + move github pages from branch … Aug 23, 2017
Jenkinsfile Added check for `sudo` (#69) May 10, 2018
LICENSE Add MIT license Jun 22, 2015
README.md Fixed escaping of godep path in README May 22, 2018
build.sh Fix up packaging Jul 31, 2017
cli.go fix: replace conjurinc with cyberark + move github pages from branch … Aug 23, 2017
docker-compose.yml Added check for `sudo` (#69) May 10, 2018
install.sh Added check for `sudo` (#69) May 10, 2018
main.go Fail more gracefully on unknown flags #24 Feb 29, 2016
package.sh We don't need the VERSION when packaging Jul 31, 2017
secrets_publish.yml publish to bintray May 30, 2015
test.sh Build and unit test with docker-compose Jul 31, 2017
version.go summon no longer buffers wrapped process stdout output [CONJ-4705] (#64) Feb 6, 2018

README.md

summon


summon is a command-line tool to make working with secrets easier.

It provides an interface for

  • Reading a secrets.yml file
  • Fetching secrets from a trusted store
  • Exporting secret values to a sub-process environment

Note that summon is still in early stages, we are looking for feedback and contributions.

Install

Note basic summon install is not fully functional; you need to also install a provider of your choice before it's ready for use.

OSX

Install via Homebrew.

brew tap cyberark/tools
brew install summon

Linux

Use the auto-install script. This will install the latest version of summon. The script requires sudo to place summon in /usr/local/bin.

curl -sSL https://raw.githubusercontent.com/cyberark/summon/master/install.sh | bash

For other platforms, download the latest release and unzip it to a location on your PATH.

Usage

By default, summon will look for secrets.yml in the directory it is called from and export the secret values to the environment of the command it wraps.

Example

You want to run script that requires AWS keys to list your EC2 instances.

Define your keys in a secrets.yml file

AWS_ACCESS_KEY_ID: !var aws/iam/user/robot/access_key_id
AWS_SECRET_ACCESS_KEY: !var aws/iam/user/robot/secret_access_key

The script uses the Python library boto, which looks for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the environment.

import boto
botoEC2 = boto.connect_ec2()
print(botoEC2.get_all_instances())

Wrap the Python script in summon:

summon python listEC2.py

python listEC2.py is the command that summon wraps. Once the Python program exits, the secrets stored in temp files and in the Python process environment are gone.

Flags

summon supports a number of flags.

  • -p, --provider specify the path to the provider summon should use

    If the provider is in the default path, /usr/local/lib/summon/ you can just provide the name of the executable. If not, use a full path.

  • -f <path> specify a location to a secrets.yml file, default 'secrets.yml' in current directory.

  • -D 'var=value' causes substitution of value to $var.

    You can use the same secrets.yml file for different environments, using -D to substitute variables. This flag can be used multiple times.

    Example

    summon -D ENV=production --yaml 'SQL_PASSWORD: !var env/$ENV/db-password' deploy.sh
    
  • -i, --ignore A secret path for which to ignore provider errors

    This flag can be useful for when you have secrets that you don't need access to for development. For example API keys for monitoring tools. This flag can be used multiple times.

  • -e, --environment Specify section (environment) to parse from secret YAML

    This flag specifies which specific environment/section to parse from the secrets YAML file (or string). In addition, it will also enable the usage of a common (or default) section which will be inherited by other sections/environments. In other words, if your secrets.yaml looks something like this:

common:
  DB_USER: db-user
  DB_NAME: db-name
  DB_HOST: db-host.example.com

staging:
  DB_PASS: some_password

production:
  DB_PASS: other_password

Doing something along the lines of: summon -f secrets.yaml -e staging printenv | grep DB_, summon will populate DB_USER, DB_NAME, DB_HOST with values from common and set DB_PASS to some_password.

Note: default is an alias for common section. You can use either one.

View help and all flags with summon -h.

env-file

Using Docker? When you run summon it also exports the variables and values from secrets.yml in VAR=VAL format to a memory-mapped file, its path made available as @SUMMONENVFILE.

You can then pass secrets to your container using Docker's --env-file flag like so:

summon docker run --env-file @SUMMONENVFILE myorg/myimage

This file is created on demand - only when @SUMMONENVFILE appears in the arguments of the command summon is wrapping. This feature is not Docker-specific; if you have another tools that reads variables in VAR=VAL format you can use @SUMMONENVFILE just the same.

Development

Dependencies are vendored with godep. To make them available, run export GOPATH=$(godep path):$GOPATH.

Run the project with:

go run *.go

Testing

Tests are written using GoConvey. Run tests with go test -v ./... or ./test.sh (for CI).

Building

To build 64bit versions for Linux, OSX and Windows:

./build.sh

Binaries will be placed in output/.

Packaging

./package.sh