5 ms·

An Interactive HashiCorp Vault Shell

46 points by fishi0x01 7y ago

aargh_aargh 7y ago
Cool, but why not FUSE?
- eikenberry 7y ago
  Isn't FUSE mostly *nix specific? At first glance this seems to be platform agnostic.
  - fishi0x01 7y ago
    Good point. Main targets are Mac and Unix. MS should be compatible too, but some of the deps don't test if they are really working on MS. Afaik Mac and Unix should be supported by FUSE, so it seems like a viable option.
  - jasonjayr 7y ago
    https://github.com/billziss-gh/winfsp https://github.com/billziss-gh/winfsp https://dokan-dev.github.io/ https://dokan-dev.github.io/ A few options exist for Windows already, allowing FUSE filesytem code an easy path to run on Windows. I've recently used winfsp + it's sshfs port, and it works pretty well.
- fishi0x01 7y ago
  Haven't thought about it tbh. But that is an interesting idea! Are there any reasonable go libraries for FUSE that you can recommend?
  - 4ad 7y ago
    https://bazil.org/fuse https://bazil.org/fuse
dennis-tra 7y ago
Nice work, I once built a terminal UI for Vault. Did not get any attention at all. Works wonders for me: https://github.com/hashicorp/vault/pull/6108 https://github.com/hashicorp/vault/pull/6108
- olalonde 7y ago
  I feel bad for you, they didn't even leave a comment on the PR :(
boardwaalk 7y ago
It seems, to me, like a normal command line tool that has the operations you want would integrate better with workflows. Here you can use “-c” but then you’d have to deal with quoting and such. Seems like a big impedance mismatch to pay for “working directory” functionality. ... I don’t have a super tree of Vault secrets though (it’s one level, actually).
- fishi0x01 7y ago
  You are right, it is nothing fancy indeed. The "-c" is mainly intended for automation if needed. Main motivation behind this project is that I am currently working with rather large secret trees and will have to move them around for upcoming refactors. I could also write scripts for that with the vault client of course .. but it felt to me easier and more flexible on the long-run to have a shell-like approach to work with. In my case, the refactor will include a shift from KV1 to KV2, which is also covered by that tool. Further, I saw this as an opportunity to do some coding :)
boeroboy 7y ago
I already wrote FUSE clients for all of Hashicorp's products actually. https://github.com/jboero/hashifuse https://github.com/jboero/hashifuse
- boeroboy 7y ago
  Also K8s (experimental)
  - kiney 7y ago
    That's really cool. Will try it out.
- fishi0x01 7y ago
  It covers the whole stack. Nice! Will try it. Thanks for sharing
lingrino 7y ago
Very cool! I have a very similar (non-interactive) project for copy/move/search on folders. It's something I think should be added to the vault core but there doesn't seem to be much interest there. https://github.com/lingrino/vaku https://github.com/lingrino/vaku
- fishi0x01 7y ago
  This looks amazing! Nice parallel worker approach :) Thank you for sharing

46 points by fishi0x01 7y ago

aargh_aargh 7y ago

Cool, but why not FUSE?

eikenberry 7y ago
Isn't FUSE mostly *nix specific? At first glance this seems to be platform agnostic.
- fishi0x01 7y ago
  Good point. Main targets are Mac and Unix. MS should be compatible too, but some of the deps don't test if they are really working on MS. Afaik Mac and Unix should be supported by FUSE, so it seems like a viable option.
- jasonjayr 7y ago
  https://github.com/billziss-gh/winfsp https://github.com/billziss-gh/winfsp https://dokan-dev.github.io/ https://dokan-dev.github.io/ A few options exist for Windows already, allowing FUSE filesytem code an easy path to run on Windows. I've recently used winfsp + it's sshfs port, and it works pretty well.
fishi0x01 7y ago
Haven't thought about it tbh. But that is an interesting idea! Are there any reasonable go libraries for FUSE that you can recommend?
- 4ad 7y ago
  https://bazil.org/fuse https://bazil.org/fuse

dennis-tra 7y ago

Nice work, I once built a terminal UI for Vault. Did not get any attention at all. Works wonders for me: https://github.com/hashicorp/vault/pull/6108 https://github.com/hashicorp/vault/pull/6108

olalonde 7y ago
I feel bad for you, they didn't even leave a comment on the PR :(

boardwaalk 7y ago

It seems, to me, like a normal command line tool that has the operations you want would integrate better with workflows. Here you can use “-c” but then you’d have to deal with quoting and such. Seems like a big impedance mismatch to pay for “working directory” functionality. ... I don’t have a super tree of Vault secrets though (it’s one level, actually).

fishi0x01 7y ago
You are right, it is nothing fancy indeed. The "-c" is mainly intended for automation if needed. Main motivation behind this project is that I am currently working with rather large secret trees and will have to move them around for upcoming refactors. I could also write scripts for that with the vault client of course .. but it felt to me easier and more flexible on the long-run to have a shell-like approach to work with. In my case, the refactor will include a shift from KV1 to KV2, which is also covered by that tool. Further, I saw this as an opportunity to do some coding :)

boeroboy 7y ago

I already wrote FUSE clients for all of Hashicorp's products actually. https://github.com/jboero/hashifuse https://github.com/jboero/hashifuse

boeroboy 7y ago
Also K8s (experimental)
- kiney 7y ago
  That's really cool. Will try it out.
fishi0x01 7y ago
It covers the whole stack. Nice! Will try it. Thanks for sharing

lingrino 7y ago

Very cool! I have a very similar (non-interactive) project for copy/move/search on folders. It's something I think should be added to the vault core but there doesn't seem to be much interest there. https://github.com/lingrino/vaku https://github.com/lingrino/vaku

fishi0x01 7y ago
This looks amazing! Nice parallel worker approach :) Thank you for sharing