m7

Author: ned1313

m5/2-create-entities-aliases.ps1

@@ -21,10 +21,12 @@ vault write identity/alias name=fprefect mount_accessor=$mount_accessor canonica
 # Vault Agent later
 vault write identity/entity name=vaultagent
 
+$role_id=$(vault read auth/approle/role/web-role/role-id -format=json) | ConvertFrom-Json
+
 $mount_accessor=$authmethods.data."approle/".accessor
 $vaultagent_id=$(vault read identity/entity/name/vaultagent -format=json) | ConvertFrom-Json
 $canonical_id=$vaultagent_id.data.id
-vault write identity/alias name=vaultagent mount_accessor=$mount_accessor canonical_id=$canonical_id
+vault write identity/alias name=$($role_id.data.role_id) mount_accessor=$mount_accessor canonical_id=$canonical_id
 
 # Now onto creating an internal group for Arthur and Ford as administrators
 vault path-help identity/group

m5/2-create-entities-aliases.sh

@@ -21,9 +21,13 @@ vault write identity/alias name=fprefect \
 # Vault Agent later
 vault write identity/entity name=vaultagent
 
+# We need to get the role-id for the name
+role_id=$(vault read auth/approle/role/web-role/role-id -format=json | jq .data.role_id -r)
+
 mount_accessor=$(vault read sys/auth/ -format=json | jq .data.\"approle/\".accessor -r)
 canonical_id=$(vault read identity/entity/name/vaultagent -format=json | jq .data.id -r)
-vault write identity/alias name=vaultagent \
+
+vault write identity/alias name=$role_id \
   mount_accessor=$mount_accessor \
   canonical_id=$canonical_id
 

m7/1-start-vault-agent.sh

@@ -0,0 +1,27 @@
+# Make sure you are in the m7 directory or this won't work very well
+
+# Make sure your Vault server container is up and running
+docker container ls
+
+# Let's set our vault env variables
+export VAULT_ADDR="https://127.0.0.1:8200"
+export VAULT_SKIP_VERIFY=true
+
+# Make sure vault isn't sealed
+vault status
+vault login
+
+# We need to get the role-id and secret-id for the vault agent
+role_id=$(vault read auth/approle/role/web-role/role-id -format=json | jq .data.role_id -r)
+
+secret_id=$(vault write -f auth/approle/role/web-role/secret-id -format=json | jq .data.secret_id -r)
+
+# Now we'll write both values out to files for use by the agent
+echo $role_id > role_id.txt
+echo $secret_id > secret_id.txt
+
+# Next we'll put a secret into the apikeys secrets engine
+vault kv put apikeys/key1 key=456yujnbgty678ikjhgty67u
+
+# And now we can start up the vault agent
+vault agent -config=vault-agent.hcl

m7/template.ctmpl

@@ -0,0 +1,3 @@
+{{ with secret "apikeys/key1" }}
+{{ .Data.data.key }}
+{{ end }}

m7/vault-agent.hcl

@@ -0,0 +1,35 @@
+vault {
+    address = "https://127.0.0.1:8200"
+}
+
+auto_auth {
+    method "approle" {
+        mount_path = "auth/approle"
+        config = {
+          role_id_file_path = "role_id.txt"
+          secret_id_file_path = "secret_id.txt"
+          remove_secret_id_file_after_reading = false
+        }
+    }
+
+    sink "file" {
+        config = {
+            path = "token.txt"
+        }
+    }
+
+}
+
+cache {
+    use_auto_auth_token = true
+}
+
+listener "tcp" {
+  address = "127.0.0.1:8100"
+  tls_disable = true
+}
+
+template {
+  source = "template.ctmpl"
+  destination = "render.txt"
+}