How to write roles and policies in Hashicorp Vault using a pipeline

Viewed 1755

I am using Hashicorp Vault for managing and storing my secrets. And using Gitlab as a CI/CD pipeline to read those secrets. Using this documentation https://docs.gitlab.com/ee/ci/examples/authenticating-with-hashicorp-vault/, I am able to read the secrets using JWT. But those secrets/roles/policies I had already configured from Vault CLI

What i want to know is if there is a way to create policies and roles using directly from the pipeline. For example 1st step is to create the role like this -

$ vault write auth/jwt/role/myproject-production - <<EOF
{
  "role_type": "jwt",
  "policies": ["myproject-production"],
  "token_explicit_max_ttl": 60,
  "user_claim": "user_email",
  "bound_claims_type": "glob",
  "bound_claims": {
    "project_id": "42",
    "ref_protected": "true",
    "ref_type": "tag",
    "ref": "auto-deploy-*"
  }
}
EOF

Here you can see I have attached a policy myproject-production to this role which will be created like this -

$ vault policy write myproject-production - <<EOF
# Policy name: myproject-production
#
# Read-only permission on 'secret/data/myproject/production/*' path
path "secret/data/myproject/production/*" {
  capabilities = [ "read" ]
}
EOF

How do i perform these 2 steps from a pipeline after Authentication happens successfully from Vault.? Right now what i am doing is when a new user comes in, I go and create policy and roles for him and the same the user uses in the pipeline to read the secrets.

0 Answers
Related