vcli

A remote command line interface for HashiCorp's Vault written in bash using as many builtin commands as possible. Currently only supporting api version v1 and tested on vault 0.9.x

Why vcli

vcli's purpose is to ease the management of secrets when developing applications that make use of Vault. As every bash script that's grown beyond it's purpose, vcli started with a simple 'for' statement to ease the browse of a HashiCorp's Vault server. It continued as a challenge of what can be achieved simply using bash with its 4.x version powerful features. Now it has become a useful tool here at Stratio

Features

shows Vault's HTTP status code after each command
persist history on ~/.vclistory
Ctrl+r: history search
up & down arrows can be used to select commands from the history
!$: special variable to access last valid command's path
tree command implementation
commands & paths completion using 'tab' key
autoexpands shell variables in the JSON to upload when using put command
enable-debug/disable-debug: commands to enable/disable debug output to /tmp/debug
if exported, vcli will use $VAULT_HOST, $VAULT_TOKEN and $VAULT_PORT or $VAULT_ADDR to connect to Vault
Can be exited with Ctrl+d or with exit command

Can be run in batch mode:

cat << V | /stratio/secret-utils/vcli -v vault.service.eos.alpha.hetzner.stratio.com -t <root_token> -n
put /userland/passwords/test {"user":"myuser","pass":"verysecurepass" }
cat /userland/passwords/test
rm /userland/passwords/test
ls /userland/passwords/
V

Demo

Known bugs

If you cd path instead of path/ you will not be able to refer to secrets:

[200] vcli@vault.service.test:8200/userland/passwords > cat test
{
  "errors": []
}
[404] vcli@vault.service.test:8200/userland/passwords > cd /userland/passwords/
[404] vcli@vault.service.test:8200/userland/passwords/ > cat test
{
  "request_id": "c9a74db2-740b-8ac4-dd4f-0fe58df085f8",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 2764800,
  "data": {
    "pass": "t35t",
    "user": "test"
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}

It's better to use tab to autocomplete when changing path as it automatically inserts the last /

If you type really fast enough you may incur a race condition on the loop that manages the keyboard input.
Home/End keys do not work when ran within a screen shell

Contributors

Marcos Lorenzo (Creator) (mlorenzo-stratio)
Ángel Prada (angelprada)
Viktor Jacynycz (vjacynycz-stratio)

mlorenzo-stratio / vcli