mumoshu / sopsed

Spawning and storage of secure environments powered by sops, inspired from vaulted. Out-of-box support for kubectl, kube-aws, helm, helmfile
9 stars 2 forks source link

Re-designing expected user-experience #5

Open mumoshu opened 6 years ago

mumoshu commented 6 years ago

I'm leaving random notes about expected user experience of this tool here.

You'll firstly initialize your project by running the following command in your project root:

sopsed init

This will create a default vault which is empty at beginning.

You then add any of: env-var, file, ssh-key to the vault by running:

$ sopsed add sshkey relative/or/absolute/path/to/your/ssh/private/key
WARN: your ssh key has been added to the `default` vault. Please remove the original file for security!

$ export FOO=mysecretvalue
$ sopsed add env FOO
WARN: envvar named FOO with value ****(obfuscated) has been added to the `default` vault. Please remove the env var from your shell session for security!

$ sopsed add file ./path/to/your/file # file outside of project tree isn't allowed
WARN: envvar named FOO with value ****(obfuscated) has been added to the `default` vault. Please remove the env var from your shell session for security!

Now, you can run any command within the default vault by:

$ sopsed run -- bash -c export

You can also create, manage, use a vault named other than default by:

$ sopsed init myvault
$ sopsed show -n myvault
$ sopsed add -n myvault sshkey path/to/your/ssh/key
$ sopsed add -n myvault env FOO
$ sopsed add -n myvault file ./path/to/your/file
$ sopsed show -n myvault
$ sopsed run -- bash -c export

2 on top of this is still something TBD.

mumoshu commented 6 years ago

For #2, how about something like this?

# NICE TO HAVE: Interactive way to enable autoselection per vault
# -c stands for "criteria" or "command"
$ sopsed autoselect myvault -c '[ "$SOPSED_COMMAND" == "mycmd" ]'

# This also shows the autoselection criteria in the output
$ sopsed show myvault

# sopsed auto-select `myvault` even though `-n myvault` isn't specified
# this fails emitting `no default vault found for mycmd --foo --bar` in case you don't have a default vault and there are two or more vaults in `.sopsed/`
$ sopsed run -- mycmd --foo --bar