channable / channable/vaultenv
Add support for `--kv-version`
- Dominant language
- Haskell
- Stars
- 466
- Forks
- 29
- Avg merge
- 26m
- Merged PRs (30d)
- 1
Description
It is so nice that `vaultenv` do not need to know which KV version (1 or 2) is used and the fact that support auto-discovery.
https://github.com/channable/vaultenv/blob/d6fda1a1710176a316c382aeaf08d98845f74db3/README.md?plain=1#L13-L15
Unfortunately, in our setup, we do not have access to `/v1/sys/mounts` so `vaultenv` fails with following
```bash
$ ./vaultenv --secrets-file .env --log-level info -- env
Host: <...>
Port: 443
Addr: https://<...>
Authentication method: None
Auth backend: Unspecified
Secret file: .env
Command: env
Arguments: []
Use TLS: True
Validate certs: True
Inherit env: True
Inherit env blacklist: []
Base delay: 40 ms
Retry attempts: 9
Log-level: Info
Use PATH: True
Concurrent requests: 8
[ERROR] ServerUnreachable error: HttpExceptionRequest Request {
host = "<...>"
port = 443
secure = True
requestHeaders = [("x-vault-request","true"),("x-vault-token","**removed**")]
path = "/v1/sys/mounts"
queryString = ""
method = "GET"
proxy = Nothing
rawBody = False
redirectCount = 10
responseTimeout = ResponseTimeoutDefault
requestVersion = HTTP/1.1
proxySecureMode = ProxySecureWithConnect
}
(InternalException ProtocolError "error:16000069:STORE routines::unregistered scheme")
```
and
```bash
$ curl https://<...>/v1/sys/mounts -H 'x-vault-request: true' -H "x-vault-token: <...>"
{"errors":["1 error occurred:\n\t* permission denied\n\n"]}
```
Is there any way to add support for extra attribute (and related environment variable) which would be able to instruct `vaultenv`, which version it is using?
Contributor guide
No contributing guide indexed for this repository
Research direction
Read the KV autodiscovery description in README.md and reproduce the shown vaultenv command against a Vault setup where /v1/sys/mounts is forbidden. Trace the CLI configuration and make the requested --kv-version option and related environment variable select KV 1 or 2 without requiring mount access; done means the command can load secrets in that setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100