cruise-automation / daytona

A Vault client, but for containers and servers.
Apache License 2.0
310 stars 33 forks source link

Simply and clarify the secret fetching process #33

Closed broamski closed 4 years ago

broamski commented 4 years ago

This PR simplifies the secret fetching process with the introduction of SecretDefinitions, which contain relevant data around fetching a specified set of secrets.

Externally, a Secret Definition is defined via: VAULT_SECRET_THING=my/vault/path/to/a/key either with a corresponding DAYTONA_SECRET_DESTINATION_THING=/path/to/output or a -secret-env argument. Please note that the suffix is no longer required to match the final key name in the vault path.

Before this change, note that the suffix THING in VAULT_SECRET_THING was required to match the key name of the vault path:

VAULT_SECRET_THING=my/vault/path/to/a/thing
DAYTONA_SECRET_DESTINATION_THING=/path/to/output

# the following would not work:
VAULT_SECRET_THINGY=my/vault/path/to/a/thing
DAYTONA_SECRET_DESTINATION_THINGY=/path/to/output

This PR introduces arbitrary suffix identifiers:

VAULT_SECRET_WHATUP=my/vault/path/to/a/thing/called/hello
DAYTONA_SECRET_DESTINATION_WHATUP=/path/to/output

Secret Definition Decoder Guide

Singular Secrets

This PR also now enables support for using Plural Secret Storage Path Prefixes VAULT_SECRETS_<secretID-SUFFIX> with Secret Destination Prefixes DAYTONA_SECRET_DESTINATION_, which intended to deprecate the -secret-path command line flag.

Thank you @robison for authoring the additional tests.

broamski commented 4 years ago

@robison I updated the README to reflect these changes.