Vault Converter

Support converting Vault Secrets to different formats.

vault-converter is a tool designed to synchronize variables from local to Vault and vice versa.

Supported extensions:

• tfvars
• env

vault-converter uses Vault authentication method as userpass with fixed path userpass/. But you still can authenticate with token method by create a file contain client token at "$HOME/.vault-token".

Secret Engine supports Key/Value Version 2 (kv2).

Installation

Binaries (recommended)

Download your preferred asset from the releases page and install manually.

Source code

# clone repo to some directory outside GOPATH
git clone https://github.com/vietanhduong/vault-converter

cd vault-converter

go mod download

go build . 

Usage

Currently, vault-converter supports synchronize variables from Vault to local and vice versa.

$ vault-converter --help
Convert to file from Vault. Support multiple file format like '.tfvars', '.env'

Usage:
  vault-converter [flags]
  vault-converter [command]

Available Commands:
  auth        Authenticates users to Vault
  completion  generate the autocompletion script for the specified shell
  help        Help about any command
  pull        Pull secrets from Vault and convert to file
  push        Parse source file and push to Vault

Flags:
  -h, --help      help for vault-converter
  -v, --version   Print version information and exit. This flag is only available at the global level.

Use "vault-converter [command] --help" for more information about a command.

Authenticate

User authentication with Vault

$ vault-converter auth --help
Authenticates users to Vault using the provided arguments. 
Method using: 'userpass'. The path of 'userpass' should be 'userpass/'

Usage:
  vault-converter auth [flags]

Flags:
  -a, --address string    Address of the Vault server. This can also be specified via the VAULT_ADDR environment variable. (default "https://dev-vault.knstats.com")
  -h, --help              help for auth
  -p, --password string   The user's password. This can also be specified via the VAULT_PASSWORD environment variables.
  -u, --username string   The username to authenticate with Vault server. This can also be specified via the VAULT_USER environment variables.

Global Flags:
  -v, --version   Print version information and exit. This flag is only available at the global level.

Sync variables from Vault to local

When you pull variables from Vault to local. vault-convert automatically override the content to the output file. Keep it in mind, if you don't want your variables to disappear.

$ vault-converter pull --help
Pull secrets from Vault with specified secret path and convert to file.
SECRET_PATH should be a absolute path at Vault and the values should be in JSON format.
Supports the following formats: "tfvars"

Usage:
  vault-converter pull SECRET_PATH [flags]

Flags:
  -a, --address string   Address of the Vault server. This can also be specified via the VAULT_ADDR environment variable. (default "https://dev-vault.knstats.com")
  -f, --format string    Output format (default "tfvars")
  -h, --help             help for pull
  -o, --output string    Output path. E.g: ~/data/variables.auto.tfvars (default "variables.auto.tfvars")

Global Flags:
  -v, --version   Print version information and exit. This flag is only available at the global level.

Sync variables from local to Vault

Sync variables from local to Vault. If the SECRET_PATH doesn't exist. vault-converter automatically create new path and push the content in there. But if the root path (secret engine path) does NOT exist, the request will be fail .

$ vault-converter push --help
Parse source file and push secrets to Vault.
Based on the extension of SOURCE_FILE to determine the file format. 
SECRET_PATH should be a absolute path at Vault and the values should 
be in JSON format.
Supports the following formats: "tfvars"

Usage:
  vault-converter push SOURCE_FILE SECRET_PATH [flags]

Flags:
  -a, --address string   Address of the Vault server. This can also be specified via the VAULT_ADDR environment variable. (default "https://dev-vault.knstats.com")
  -h, --help             help for push

Global Flags:
  -v, --version   Print version information and exit. This flag is only available at the global level.

List secret paths from Vault

List all secret paths from Vault. This feature will try to list all secret paths base on user permissions. If input path does not specify, it will return all secret.

You can list all secret paths by recursive by using -r or --recursive flags.

$ vault-converter ls --help
List all secret path in input [SECRET_PATH]. If the input [SECRET_PATH] is empty.
It will return all secret from 'root'. It will try to get all secret that current user
can 'read'.

Usage:
  vault-converter ls [SECRET_PATH] [flags]

Flags:
  -a, --address string   addr of the Auth server. This can also be specified via the VAULT_ADDR environment variable. (default "https://127.0.0.1:8200")
  -h, --help             help for ls
  -r, --recursive        List secret recursive or not.

Global Flags:
  -v, --version   Print version information and exit. This flag is only available at the global level.