Skip to content

Commit ac64af6

Browse files
matifalimafredri
matifali
and
mafredri
authored
Update Hashicorp vault modules (#140)
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
1 parent b299f98 commit ac64af6

File tree

5 files changed

+307
-46
lines changed

5 files changed

+307
-46
lines changed

‎vault-github/run.sh

+57-46
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/usr/bin/env sh
1+
#!/usr/bin/env bash
22

33
# Convert all templated variables to shell variables
44
INSTALL_VERSION=${INSTALL_VERSION}
@@ -20,7 +20,7 @@ fetch() {
2020
fi
2121
}
2222

23-
unzip() {
23+
unzip_safe() {
2424
if command -v unzip > /dev/null 2>&1; then
2525
command unzip "$@"
2626
elif command -v busybox > /dev/null 2>&1; then
@@ -31,57 +31,68 @@ unzip() {
3131
fi
3232
}
3333

34-
# Fetch the latest version of Vault if INSTALL_VERSION is 'latest'
35-
if [ "$${INSTALL_VERSION}" = "latest" ]; then
36-
LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -oP 'vault/\K[0-9]+\.[0-9]+\.[0-9]+' | sort -V | tail -n 1)
37-
printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
38-
if [ -z "$${LATEST_VERSION}" ]; then
39-
printf "Failed to determine the latest Vault version.\n"
40-
exit 1
34+
install() {
35+
# Fetch the latest version of Vault if INSTALL_VERSION is 'latest'
36+
if [ "$${INSTALL_VERSION}" = "latest" ]; then
37+
LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -oP 'vault/\K[0-9]+\.[0-9]+\.[0-9]+' | sort -V | tail -n 1)
38+
printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
39+
if [ -z "$${LATEST_VERSION}" ]; then
40+
printf "Failed to determine the latest Vault version.\n"
41+
return 1
42+
fi
43+
INSTALL_VERSION=$${LATEST_VERSION}
4144
fi
42-
VERSION=$${LATEST_VERSION}
43-
fi
4445

45-
# Check if the vault CLI is installed and has the correct version
46-
installation_needed=1
47-
if command -v vault > /dev/null 2>&1; then
48-
CURRENT_VERSION=$(vault version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
49-
if [ "$${CURRENT_VERSION}" = "$${INSTALL_VERSION}" ]; then
50-
printf "Vault version %s is already installed and up-to-date.\n\n" "$${CURRENT_VERSION}"
51-
installation_needed=0
46+
# Check if the vault CLI is installed and has the correct version
47+
installation_needed=1
48+
if command -v vault > /dev/null 2>&1; then
49+
CURRENT_VERSION=$(vault version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
50+
if [ "$${CURRENT_VERSION}" = "$${INSTALL_VERSION}" ]; then
51+
printf "Vault version %s is already installed and up-to-date.\n\n" "$${CURRENT_VERSION}"
52+
installation_needed=0
53+
fi
5254
fi
53-
fi
5455

55-
if [ $${installation_needed} -eq 1 ]; then
56-
# Download and install Vault
57-
if [ -z "$${CURRENT_VERSION}" ]; then
58-
printf "Installing Vault CLI ...\n\n"
59-
else
60-
printf "Upgrading Vault CLI from version %s to %s ...\n\n" "$${CURRENT_VERSION}" "$${VERSION}"
61-
fi
62-
fetch vault.zip "https://releases.hashicorp.com/vault/$${VERSION}/vault_$${VERSION}_linux_amd64.zip"
63-
if [ $? -ne 0 ]; then
64-
printf "Failed to download Vault.\n"
65-
exit 1
66-
fi
67-
unzip vault.zip
68-
if [ $? -ne 0 ]; then
69-
printf "Failed to unzip Vault.\n"
70-
exit 1
71-
fi
72-
rm vault.zip
73-
if sudo mv vault /usr/local/bin/vault 2> /dev/null; then
74-
printf "Vault installed successfully!\n\n"
75-
else
76-
mkdir -p ~/.local/bin
77-
mv vault ~/.local/bin/vault
78-
if [ ! -f ~/.local/bin/vault ]; then
79-
printf "Failed to move Vault to local bin.\n"
80-
exit 1
56+
if [ $${installation_needed} -eq 1 ]; then
57+
# Download and install Vault
58+
if [ -z "$${CURRENT_VERSION}" ]; then
59+
printf "Installing Vault CLI ...\n\n"
60+
else
61+
printf "Upgrading Vault CLI from version %s to %s ...\n\n" "$${CURRENT_VERSION}" "${INSTALL_VERSION}"
62+
fi
63+
fetch vault.zip "https://releases.hashicorp.com/vault/$${INSTALL_VERSION}/vault_$${INSTALL_VERSION}_linux_amd64.zip"
64+
if [ $? -ne 0 ]; then
65+
printf "Failed to download Vault.\n"
66+
return 1
67+
fi
68+
if ! unzip_safe vault.zip; then
69+
printf "Failed to unzip Vault.\n"
70+
return 1
71+
fi
72+
rm vault.zip
73+
if sudo mv vault /usr/local/bin/vault 2> /dev/null; then
74+
printf "Vault installed successfully!\n\n"
75+
else
76+
mkdir -p ~/.local/bin
77+
if ! mv vault ~/.local/bin/vault; then
78+
printf "Failed to move Vault to local bin.\n"
79+
return 1
80+
fi
81+
printf "Please add ~/.local/bin to your PATH to use vault CLI.\n"
8182
fi
82-
printf "Please add ~/.local/bin to your PATH to use vault CLI.\n"
8383
fi
84+
return 0
85+
}
86+
87+
TMP=$(mktemp -d)
88+
if ! (
89+
cd "$TMP"
90+
install
91+
); then
92+
echo "Failed to install Vault CLI."
93+
exit 1
8494
fi
95+
rm -rf "$TMP"
8596

8697
# Authenticate with Vault
8798
printf "🔑 Authenticating with Vault ...\n\n"

‎vault-token/README.md

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
display_name: Hashicorp Vault Integration (Token)
3+
description: Authenticates with Vault using Token
4+
icon: ../.icons/vault.svg
5+
maintainer_github: coder
6+
partner_github: hashicorp
7+
verified: true
8+
tags: [helper, integration, vault, token]
9+
---
10+
11+
# Hashicorp Vault Integration (Token)
12+
13+
This module lets you authenticate with [Hashicorp Vault](https://www.vaultproject.io/) in your Coder workspaces using a [Vault token](https://developer.hashicorp.com/vault/docs/auth/token).
14+
15+
```tf
16+
variable "vault_token" {
17+
type = string
18+
description = "The Vault token to use for authentication."
19+
sensitive = true
20+
}
21+
22+
module "vault" {
23+
source = "registry.coder.com/modules/vault-token/coder"
24+
version = "1.0.3"
25+
agent_id = coder_agent.example.id
26+
vault_token = var.token
27+
vault_addr = "https://vault.example.com"
28+
}
29+
```
30+
31+
Then you can use the Vault CLI in your workspaces to fetch secrets from Vault:
32+
33+
```shell
34+
vault kv get -namespace=coder -mount=secrets coder
35+
```
36+
37+
or using the Vault API:
38+
39+
```shell
40+
curl -H "X-Vault-Token: ${VAULT_TOKEN}" -X GET "${VAULT_ADDR}/v1/coder/secrets/data/coder"
41+
```
42+
43+
## Configuration
44+
45+
To configure the Vault module, you must create a Vault token with the the required permissions and configure the module with the token and Vault address.
46+
47+
1. Create a vault policy with read access to the secret mount you need your developers to access.
48+
```shell
49+
vault policy write read-coder-secrets - <<EOF
50+
path "coder/data/*" {
51+
capabilities = ["read"]
52+
}
53+
path "coder/metadata/*" {
54+
capabilities = ["read"]
55+
}
56+
EOF
57+
```
58+
2. Create a token using this policy.
59+
```shell
60+
vault token create -policy="read-coder-secrets"
61+
```
62+
3. Copy the generated token and use in your template.
63+
64+
## Examples
65+
66+
### Configure Vault integration and install a specific version of the Vault CLI
67+
68+
```tf
69+
variable "vault_token" {
70+
type = string
71+
description = "The Vault token to use for authentication."
72+
sensitive = true
73+
}
74+
75+
module "vault" {
76+
source = "registry.coder.com/modules/vault-token/coder"
77+
version = "1.0.3"
78+
agent_id = coder_agent.example.id
79+
vault_addr = "https://vault.example.com"
80+
vault_token = var.token
81+
vault_cli_version = "1.15.0"
82+
}
83+
```

‎vault-token/main.test.ts

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import { describe } from "bun:test";
2+
import { runTerraformInit, testRequiredVariables } from "../test";
3+
4+
describe("vault-token", async () => {
5+
await runTerraformInit(import.meta.dir);
6+
7+
testRequiredVariables(import.meta.dir, {
8+
agent_id: "foo",
9+
vault_addr: "foo",
10+
vault_token: "foo",
11+
});
12+
});

‎vault-token/main.tf

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
coder = {
6+
source = "coder/coder"
7+
version = ">= 0.12.4"
8+
}
9+
}
10+
}
11+
12+
# Add required variables for your modules and remove any unneeded variables
13+
variable "agent_id" {
14+
type = string
15+
description = "The ID of a Coder agent."
16+
}
17+
18+
variable "vault_addr" {
19+
type = string
20+
description = "The address of the Vault server."
21+
}
22+
23+
variable "vault_token" {
24+
type = string
25+
description = "The Vault token to use for authentication."
26+
sensitive = true
27+
}
28+
29+
variable "vault_cli_version" {
30+
type = string
31+
description = "The version of Vault to install."
32+
default = "latest"
33+
validation {
34+
condition = can(regex("^(latest|[0-9]+\\.[0-9]+\\.[0-9]+)$", var.vault_cli_version))
35+
error_message = "Vault version must be in the format 0.0.0 or latest"
36+
}
37+
}
38+
39+
data "coder_workspace" "me" {}
40+
41+
resource "coder_script" "vault" {
42+
agent_id = var.agent_id
43+
display_name = "Vault (Token)"
44+
icon = "/icon/vault.svg"
45+
script = templatefile("${path.module}/run.sh", {
46+
INSTALL_VERSION : var.vault_cli_version,
47+
})
48+
run_on_start = true
49+
start_blocks_login = true
50+
}
51+
52+
resource "coder_env" "vault_addr" {
53+
agent_id = var.agent_id
54+
name = "VAULT_ADDR"
55+
value = var.vault_addr
56+
}
57+
58+
resource "coder_env" "vault_token" {
59+
agent_id = var.agent_id
60+
name = "VAULT_TOKEN"
61+
value = var.vault_token
62+
}

‎vault-token/run.sh

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/usr/bin/env bash
2+
3+
# Convert all templated variables to shell variables
4+
INSTALL_VERSION=${INSTALL_VERSION}
5+
6+
fetch() {
7+
dest="$1"
8+
url="$2"
9+
if command -v curl > /dev/null 2>&1; then
10+
curl -sSL --fail "$${url}" -o "$${dest}"
11+
elif command -v wget > /dev/null 2>&1; then
12+
wget -O "$${dest}" "$${url}"
13+
elif command -v busybox > /dev/null 2>&1; then
14+
busybox wget -O "$${dest}" "$${url}"
15+
else
16+
printf "curl, wget, or busybox is not installed. Please install curl or wget in your image.\n"
17+
return 1
18+
fi
19+
}
20+
21+
unzip_safe() {
22+
if command -v unzip > /dev/null 2>&1; then
23+
command unzip "$@"
24+
elif command -v busybox > /dev/null 2>&1; then
25+
busybox unzip "$@"
26+
else
27+
printf "unzip or busybox is not installed. Please install unzip in your image.\n"
28+
return 1
29+
fi
30+
}
31+
32+
install() {
33+
# Fetch the latest version of Vault if INSTALL_VERSION is 'latest'
34+
if [ "$${INSTALL_VERSION}" = "latest" ]; then
35+
LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -oP 'vault/\K[0-9]+\.[0-9]+\.[0-9]+' | sort -V | tail -n 1)
36+
printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
37+
if [ -z "$${LATEST_VERSION}" ]; then
38+
printf "Failed to determine the latest Vault version.\n"
39+
return 1
40+
fi
41+
INSTALL_VERSION=$${LATEST_VERSION}
42+
fi
43+
44+
# Check if the vault CLI is installed and has the correct version
45+
installation_needed=1
46+
if command -v vault > /dev/null 2>&1; then
47+
CURRENT_VERSION=$(vault version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
48+
if [ "$${CURRENT_VERSION}" = "$${INSTALL_VERSION}" ]; then
49+
printf "Vault version %s is already installed and up-to-date.\n\n" "$${CURRENT_VERSION}"
50+
installation_needed=0
51+
fi
52+
fi
53+
54+
if [ $${installation_needed} -eq 1 ]; then
55+
# Download and install Vault
56+
if [ -z "$${CURRENT_VERSION}" ]; then
57+
printf "Installing Vault CLI ...\n\n"
58+
else
59+
printf "Upgrading Vault CLI from version %s to %s ...\n\n" "$${CURRENT_VERSION}" "${INSTALL_VERSION}"
60+
fi
61+
fetch vault.zip "https://releases.hashicorp.com/vault/$${INSTALL_VERSION}/vault_$${INSTALL_VERSION}_linux_amd64.zip"
62+
if [ $? -ne 0 ]; then
63+
printf "Failed to download Vault.\n"
64+
return 1
65+
fi
66+
if ! unzip_safe vault.zip; then
67+
printf "Failed to unzip Vault.\n"
68+
return 1
69+
fi
70+
rm vault.zip
71+
if sudo mv vault /usr/local/bin/vault 2> /dev/null; then
72+
printf "Vault installed successfully!\n\n"
73+
else
74+
mkdir -p ~/.local/bin
75+
if ! mv vault ~/.local/bin/vault; then
76+
printf "Failed to move Vault to local bin.\n"
77+
return 1
78+
fi
79+
printf "Please add ~/.local/bin to your PATH to use vault CLI.\n"
80+
fi
81+
fi
82+
return 0
83+
}
84+
85+
TMP=$(mktemp -d)
86+
if ! (
87+
cd "$TMP"
88+
install
89+
); then
90+
echo "Failed to install Vault CLI."
91+
exit 1
92+
fi
93+
rm -rf "$TMP"

0 commit comments

Comments
 (0)