Package: vaultkeeper
A Secure Introduction agent for applications consuming secrets from HashiCorp’s Vault, designed to work withvault-gatekeeper-mesos. See Jeff Mitchell’sSecure Introduction at Scalefor more background information on this project’s architecture.vaultkeepercouples the lifetime of your dynamically-generated secrets to that of your consumer applications, minimising the secrets’ temporal attack surface. When used with Dockered applications,vaultkeeper’s design ensures that your consumer app is only launched once its secrets are fetched and ready.vaultkeepersupports theSET_ROLEoperationnecessary to revoke dynamically-generated PostgreSQL credentials.Statusvaultkeeperis in PoC stage, and supports the following Vault secret backends:PostgreSQL Databases PluginRabbitMQAWSPrerequisitesTo usevaultkeepersuccessfully, you must have:A Vault instance configured and running.Avault-gatekeeper-mesosinstance configured and running with your Vault instance and Mesos instance.An application that uses Vault credentials and is configured to consumevaultkeeperoutput, such as a Django app usingdjango-vaultkeeper-adaptor.Installing the PackageClone this project and install the package from source with the following commands in the root directory of the repository:$ pip install-rrequirements.txtInstall the package for development with the following commands:$ pip install-rrequirements.txt$ pip install-e.[test]ConfigurationEnvironment VariablesVAULTKEEPER_CONFIG- A JSON string invaultkeeperconfig format. Seeconfigs/example_agent_config.jsonVAULT_SECRETS- A JSON string invaultkeepersecrets format. Seeconfigs/example_consumer_config.json.MESOS_TASK_ID- The Mesos task ID assigned to this task, which should be automatically populated by Mesos.MARATHON_APP_ID- The Marathon app ID assigned to this task, which should be automatically populated by Marathon.vaultkeeper Configurationvaultkeeperconsumes its arguments from a JSON environment variable:{"entry_cmd":"sh /scripts/django-entrypoint.sh","output_path":"","refresh_interval":30,"lease_increment":40,"renewal_grace":15}entry_cmd- The entrypoint for the application to be managed byvaultkeeper. This can be an arbitrary shell command.output_path-vaultkeeper’s output location for fetched credentials.refresh_interval- Interval (in seconds) after which to renew all leases.lease_increment- Increment (in seconds) by which to extend a lease if it is due for renewal.renewal_grace- Time (in seconds) before a lease’s expiry under which to renew the lease.secrets Configurationvaultkeeperreads in a specification for the secrets it should fetch from Vault in JSON.An example secret file containing PostgreSQL and RabbitMQ credentials is shown below:[{"id":"default","backend":"postgresql","endpoint":"0.0.0.0:5432/mydb","vault_path":"database/creds/psql-rw","schema":"public","policy":"psql-rw","set_role":"app_owner",},{"id":"broker1","backend":"rabbitmq","endpoint":"0.0.0.0:5672/myvhost","vault_path":"/rabbitmq/creds/ampq-worker","vhost":"myvhost","policy":"ampq-worker"}]Common base parameters in the secrets configuration file:id- The logical identifier for this secret. Identifiers must be unique within each consumer instance.backend- The Vault secret backend of this secret.endpoint- The endpoint for the resource. This should be a socket address with the applicable namespace (ie. vhost, database name) appended.vault_path- The Vault path from which the secret should be read.policy- The resource policy, as designated on Vault, attached to this secret.Deploymentvaultkeeperoutputs secrets as JSON. Your application needs to be able to parse and consume this output. For Django applications,django-vaultkeeper-adaptoris recommended.Supply thevaultkeeperconfiguration file with the entrypoint for the application you wish to manage. Ensure that your consumer application knows wherevaultkeeper’s secret output will be stored.Thereafter, instead of running your application’s conventional entrypoint script, runvaultkeeperinstead:$ vaultkeeper