Last built 2 months ago using go version go1.7.4 linux/amd64 and 117 seconds of time

File Size
Project-Readme for this version

Download on GoBuilder License: Apache v2.0 Go Report Card

Luzifer / vault2env

vault2env is a really small utility to transfer fields of a key in Vault into the environment. It uses the app-role, app-id authentication mechanism or simple token authentication to identify itself with the Vault server, fetches all fields in the specified key and returns export directives for bash / zsh. That way you can do eval stuff and pull those fields into your ENV.


In general this program can either output your ENV variables to use with eval or similar or it can run a program with populated environment.

# vault2env [secret path] [command]
<program is started, you see its output>

# vault2env --export [secret path]
export ...

Using evironment variables

# export VAULT_ADDR=""
# export VAULT_APP_ID="29c8febe-49f5-4620-a177-20dff0fda2da"
# export VAULT_USER_ID="54d24f66-6ecb-4dcc-bdb7-0241a955f1df"
# vault2env --export secret/my/path/with/keys
export FIRST_KEY="firstvalue"
export SECOND_KEY="secondvalue"
# eval $(vault2env --export secret/my/path/with/keys)
# echo "${FIRST_KEY}"

Using CLI parameters

The command does differ only with its parameters specified for the different authentication mechanisms:

  • When using AppRole you need to specify --vault-role-id and optionally --vault-secret-id if you’re using the bind_secret_id flag for your AppRole
  • When using AppID specify --vault-app-id and --vault-user-id
  • When using Token auth only specify --vault-token
# vault2env --vault-addr="..." --vault-app-id="..." --vault-user-id="..." secret/my/path/with/keys
export FIRST_KEY="firstvalue"
export SECOND_KEY="secondvalue"

Though it’s possible to use CLI parameters I strongly recommend to stick to the ENV variant as it’s possible under certain conditions to read CLI parameters on a shared system using for example ps aux.