channable / channable/vaultenv

Add support for `--kv-version`

Open
#155 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Haskell
Stars
466
Forks
29
Avg merge
26m
Merged PRs (30d)
1

Description

It is so nice that `vaultenv` do not need to know which KV version (1 or 2) is used and the fact that support auto-discovery.
https://github.com/channable/vaultenv/blob/d6fda1a1710176a316c382aeaf08d98845f74db3/README.md?plain=1#L13-L15

Unfortunately, in our setup, we do not have access to `/v1/sys/mounts` so `vaultenv` fails with following
```bash
$ ./vaultenv --secrets-file .env --log-level info -- env
Host: <...>
Port: 443
Addr: https://<...>
Authentication method: None
Auth backend: Unspecified
Secret file: .env
Command: env
Arguments: []
Use TLS: True
Validate certs: True
Inherit env: True
Inherit env blacklist: []
Base delay: 40 ms
Retry attempts: 9
Log-level: Info
Use PATH: True
Concurrent requests: 8
[ERROR] ServerUnreachable error: HttpExceptionRequest Request {
host = "<...>"
port = 443
secure = True
requestHeaders = [("x-vault-request","true"),("x-vault-token","**removed**")]
path = "/v1/sys/mounts"
queryString = ""
method = "GET"
proxy = Nothing
rawBody = False
redirectCount = 10
responseTimeout = ResponseTimeoutDefault
requestVersion = HTTP/1.1
proxySecureMode = ProxySecureWithConnect
}
(InternalException ProtocolError "error:16000069:STORE routines::unregistered scheme")
```
and
```bash
$ curl https://<...>/v1/sys/mounts -H 'x-vault-request: true' -H "x-vault-token: <...>"
{"errors":["1 error occurred:\n\t* permission denied\n\n"]}
```

Is there any way to add support for extra attribute (and related environment variable) which would be able to instruct `vaultenv`, which version it is using?

Contributor guide

No contributing guide indexed for this repository

Research direction

Read the KV autodiscovery description in README.md and reproduce the shown vaultenv command against a Vault setup where /v1/sys/mounts is forbidden. Trace the CLI configuration and make the requested --kv-version option and related environment variable select KV 1 or 2 without requiring mount access; done means the command can load secrets in that setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
cli
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.