• Home
  • History
  • Annotate
Name Date Size #Lines LOC

..03-May-2022-

.circleci/H07-Jul-2021-

.github/H07-Jul-2021-

clients/H07-Jul-2021-

cmd/vault-plugin-secrets-alicloud/H07-Jul-2021-

scripts/H07-Jul-2021-

vendor/H03-May-2022-

.gitignoreH A D07-Jul-2021288

LICENSEH A D07-Jul-202116.3 KiB

MakefileH A D07-Jul-20211.6 KiB

README.mdH A D07-Jul-20214.7 KiB

acceptance_test.goH A D07-Jul-20212.4 KiB

backend.goH A D07-Jul-20211.4 KiB

backend_test.goH A D07-Jul-20217 KiB

go.modH A D07-Jul-2021729

go.sumH A D07-Jul-202119.8 KiB

path_config.goH A D07-Jul-20213.4 KiB

path_creds.goH A D07-Jul-20219.3 KiB

path_creds_test.goH A D07-Jul-20211.2 KiB

path_roles.goH A D07-Jul-202110.4 KiB

path_secrets.goH A D07-Jul-20217 KiB

test_env.goH A D07-Jul-202114.6 KiB

README.md

1# Vault Plugin: AliCloud Platform Secrets Backend
2
3This is a backend plugin to be used with [Hashicorp Vault](https://www.github.com/hashicorp/vault).
4This plugin generates unique, ephemeral API keys and STS credentials.
5
6**Please note**: We take Vault's security and our users' trust very seriously.
7If you believe you have found a security issue in Vault or with this plugin,
8_please responsibly disclose_ by
9contacting us at [security@hashicorp.com](mailto:security@hashicorp.com).
10
11## Quick Links
12- [Vault Website](https://www.vaultproject.io)
13- [AliCloud Secrets Docs](https://www.vaultproject.io/docs/secrets/alicloud/index.html)
14- [Vault Github](https://www.github.com/hashicorp/vault)
15- [General Announcement List](https://groups.google.com/forum/#!forum/hashicorp-announce)
16- [Discussion List](https://groups.google.com/forum/#!forum/vault-tool)
17
18
19## Usage
20
21This is a [Vault plugin](https://www.vaultproject.io/docs/internals/plugins.html)
22and is meant to work with Vault. This guide assumes you have already installed Vault
23and have a basic understanding of how Vault works. Otherwise, first read this guide on
24how to [get started with Vault](https://www.vaultproject.io/intro/getting-started/install.html).
25
26If you are using Vault 11.0.1 or above, this plugin is packaged with Vault
27and by default can be enabled by running:
28 ```sh
29
30 $ vault secrets enable alicloud
31
32 Success! Enabled the alicloud secrets engine at: alicloud/
33
34 ```
35
36 If you are testing this plugin in an earlier version of Vault or
37 want to develop, see the next section.
38
39## Developing
40
41If you wish to work on this plugin, you'll first need [Go](https://www.golang.org)
42installed on your machine (whichever version is required by Vault).
43
44Make sure Go is properly installed, including setting up a [GOPATH](https://golang.org/doc/code.html#GOPATH).
45
46### Get Plugin
47Clone this repository:
48
49```
50
51mkdir $GOPATH/src/github.com/hashicorp/vault-plugin-secrets-alicloud`
52cd $GOPATH/src/github.com/hashicorp/
53git clone https://github.com/hashicorp/vault-plugin-secrets-alicloud.git
54
55```
56(or use `go get github.com/hashicorp/vault-plugin-secrets-alicloud` ).
57
58You can then download any required build tools by bootstrapping your environment:
59
60```sh
61$ make bootstrap
62```
63
64To compile a development version of this plugin, run `make` or `make dev`.
65This will put the plugin binary in the `bin` and `$GOPATH/bin` folders. `dev`
66mode will only generate the binary for your platform and is faster:
67
68```sh
69$ make
70$ make dev
71```
72
73### Install Plugin in Vault
74
75Put the plugin binary into a location of your choice. This directory
76will be specified as the [`plugin_directory`](https://www.vaultproject.io/docs/configuration/index.html#plugin_directory)
77in the Vault config used to start the server.
78
79```hcl
80
81plugin_directory = "path/to/plugin/directory"
82
83```
84
85Start a Vault server with this config file:
86```sh
87$ vault server -config=path/to/config.json ...
88```
89
90Once the server is started, register the plugin in the Vault server's [plugin catalog](https://www.vaultproject.io/docs/internals/plugins.html#plugin-catalog):
91
92```sh
93$ vault write sys/plugins/catalog/alicloudsecrets \
94        sha_256="$(shasum -a 256 path/to/plugin/directory/vault-plugin-secrets-alicloud | cut -d " " -f1)" \
95        command="vault-plugin-secrets-alicloud"
96```
97
98Any name can be substituted for the plugin name "alicloudsecrets". This
99name will be referenced in the next step, where we enable the secrets
100plugin backend using the AliCloud secrets plugin:
101
102```sh
103$ vault secrets enable --plugin-name='alicloudsecrets' --path="alicloud" plugin
104
105```
106
107### Tests
108
109This plugin has both integration tests, and acceptance tests.
110
111The integration tests are run by `$ make test` and rather than firing real
112API calls, they fire API calls at a local test server that returns expected
113responses.
114
115The acceptance tests fire real API calls, and are located in `acceptance_test.go`.
116These should be run once as a final step before placing a PR. Please see
117`acceptance_test.go` to learn the environment variables that will need to be set.
118
119**Warning:** The acceptance tests create/destroy/modify *real resources*,
120which may incur real costs in some cases. In the presence of a bug,
121it is technically possible that broken backends could leave dangling
122data behind. Therefore, please run the acceptance tests at your own risk.
123At the very least, we recommend running them in their own private
124account for whatever backend you're testing.
125
126To run the acceptance tests, after exporting the necessary environment variables,
127from the home directory run `go test`:
128
129```sh
130$ go test
131```
132
133## Other Docs
134
135See up-to-date [docs](https://www.vaultproject.io/docs/secrets/alicloud/index.html)
136and general [API docs](https://www.vaultproject.io/api/secret/alicloud/index.html).