deead852b5
Adds admin_users map and keyvault policy This adds an admin_users map as well as a new policy in the keyvault module. When run, this will apply an administrator policy for users in the admin_users map. With these permissions, the admin users will be able to manage secrets and keys in keyvault. 169163334 - Initial secrets-tool commit Adds admin_users map and keyvault policy This adds an admin_users map as well as a new policy in the keyvault module. When run, this will apply an administrator policy for users in the admin_users map. With these permissions, the admin users will be able to manage secrets and keys in keyvault. 170237669 - Makes the read only policy for keyvault optional and only create the policy if a principal_id is passed 170237669 - Adds new operator keyvault for secrets This is a new keyvault specifically for storing operator secrets and things that would not be accessible to applications. The primary use case for this is for launching things like postgres (root postgres creds) and other services which would require secrets to be added to the terraform configuration. This approach avoids adding secrets to terraform. An accompanying script will be added to populate the new keyvault.
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
import click
|
|
import logging
|
|
from utils.keyvault.secrets import SecretsClient
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
#loggers = [logging.getLogger(name) for name in logging.root.manager.loggerDict]
|
|
#print(loggers)
|
|
|
|
@click.group()
|
|
@click.option('--keyvault', required=True, help="Specify the keyvault to operate on")
|
|
@click.pass_context
|
|
def secrets(ctx, keyvault):
|
|
ctx.ensure_object(dict)
|
|
ctx.obj['keyvault'] = keyvault
|
|
|
|
@click.command('create')
|
|
@click.option('--key', 'key', required=True, help="Key for the secret to create")
|
|
@click.option('--value', 'value', required=True, prompt=True, hide_input=True, confirmation_prompt=True, help="Value for the secret to create")
|
|
@click.pass_context
|
|
def create_secret(ctx, key, value):
|
|
"""Creates a secret in the specified KeyVault"""
|
|
keyvault = SecretsClient(vault_url=ctx.obj['keyvault'])
|
|
keyvault.set_secret(key, value)
|
|
|
|
@click.command('list')
|
|
@click.pass_context
|
|
def list_secrets(ctx):
|
|
"""Lists the secrets in the specified KeyVault"""
|
|
keyvault = SecretsClient(vault_url=ctx.obj['keyvault'])
|
|
click.echo(keyvault.list_secrets())
|
|
|
|
|
|
secrets.add_command(create_secret)
|
|
secrets.add_command(list_secrets) |