ukhomeoffice / vaultconf Goto Github PK

Currently:

• if a resource is removed from config files it won't be removed from vault when the tool is run
• if an already existing user is updated it will also generate a new password for them

Instead we should have:

• Comparison of existing entities in vault and entities in the config is made, and reconciled
• If a user already exists instead of replacing them it should just update their policies but leave them with the same password

Could we have the secrets, aws policys etc manageable from the same tool

Make life easier for people submitting code to your repository. Make sure that you double check that their code works the best you can (even if that's just running a build of the package) in travis. This way potential contributors can fix bugs before you even need to look at their request. https://gist.github.com/PurpleBooth/6f1ba788bf70fb501439

In general, doing so places the password in user's shell history.

Alternatives:

• dot config file
• env variable
• prompt for a password

• can we have vault address default to VAULT_ADDR
• the password masked and read from stdin

Currently travis can't run cucumber tests as they require a vault server to be started. Dockerising the tests would allow them to be run with travis

I would be interested to see a couple of lines in the README with what use-cases this project was designed to solve.

Context: I came across it whilst looking for a way to import/export secrets to/from Vault. It looks like it could be used for that purpose, however the Kubernetes integration made me wonder what it was initially for.