Operations grimoire/Vault - Revision history

Dereckson: /* Get an admin-level token */

2026-03-22T18:59:45Z

Get an admin-level token

← Older revision		Revision as of 18:59, 22 March 2026
Line 138:		Line 138:
	If Vault certificate has expired, add the `--insecure` argument.		If Vault certificate has expired, add the `--insecure` argument.

	You can also ~~automate this as~~ a ~~oneliner to store the token in the default token file~~:		You can also create a $HOME/bin/vault-login helper script:

	ssh complector sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token ~~; chmod 600 ~~~/~~.vault-token~~		<syntaxhighlight language="sh">
			#!/bin/sh

			touch $HOME/.vault-token
			chmod 600 $HOME/.vault-token
			ssh complector sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py \| tr -d '\n' > $HOME/.vault-token
			</syntaxhighlight>

	== Troubleshoot ==		== Troubleshoot ==

2026-03-22T18:57:55Z

Get an admin-level token

← Older revision		Revision as of 18:57, 22 March 2026
Line 134:		Line 134:
	ssh complector		ssh complector
	cd /opt/salt/nasqueron-operations		cd /opt/salt/nasqueron-operations
	sudo ./utils/vault/issue-admin-token.py		sudo ./utils/vault/issue-admin-token.py

	If Vault certificate has expired, add the `--insecure` argument.		If Vault certificate has expired, add the `--insecure` argument.

			You can also automate this as a oneliner to store the token in the default token file:

			ssh complector sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token ; chmod 600 ~/.vault-token

	== Troubleshoot ==		== Troubleshoot ==

2026-03-02T18:00:24Z

Policies

← Older revision		Revision as of 18:00, 2 March 2026
Line 107:		Line 107:

	salt complector state.sls_id vault_policy_airflow roles/vault/policies		salt complector state.sls_id vault_policy_airflow roles/vault/policies

			Salt policies can be tested by specifying the node name:

			salt complector state.sls_id salt-node-windriver roles/vault/policies test=True

	=== DRP ===		=== DRP ===

2025-09-20T14:28:48Z

Policy for a node doesn't contain new secret entry

← Older revision		Revision as of 14:28, 20 September 2025
Line 221:		Line 221:
	#* Validate with <code>salt complector node.get roles <server name></code>		#* Validate with <code>salt complector node.get roles <server name></code>
	# Final check: <code>salt complector state.sls_id salt-node-<server name> roles/vault/policies test=True</code>		# Final check: <code>salt complector state.sls_id salt-node-<server name> roles/vault/policies test=True</code>
			# If diff is complicated to read, check the full policies document by role: <code>salt complector credentials.build_policies_by_node</code>
			#* Secret path present? Check the policy isn't already up-to-date: <code>vault policy read salt-node-<server name></code>

	==== credentials.vault_policy_present returns Bad Request ====		==== credentials.vault_policy_present returns Bad Request ====

2025-09-20T13:49:05Z

Salt: Troubleshoot new secret add

← Older revision		Revision as of 13:49, 20 September 2025
Line 211:		Line 211:

	=== Salt ===		=== Salt ===
			==== Policy for a node doesn't contain new secret entry ====
			If the policies are attached to a new role:

			# Ensure new secret have been added for the right role in {{Ops file\|pillar/credentials/vault.sls}}
			#* If missing, validate afterwards with <code>salt complector pillar.get vault_secrets_by_role:yourrole</code>
			#* You need to refresh the pillar if still missing: <code>salt complector saltutil.refresh_pillar</code>
			# Ensure role has been added to {{Ops file\|pillar/nodes/nodes.sls}} and NetBox
			#* If missing, refresh pillar afterwards
			#* Validate with <code>salt complector node.get roles <server name></code>
			# Final check: <code>salt complector state.sls_id salt-node-<server name> roles/vault/policies test=True</code>

	==== credentials.vault_policy_present returns Bad Request ====		==== credentials.vault_policy_present returns Bad Request ====

2025-09-12T21:58:28Z

Correct link is Dev zone/Vault

← Older revision		Revision as of 21:58, 12 September 2025
Line 1:		Line 1:
	''This page currently documents Vault installed on complector as part of {{Ops file\|roles/vault/}}. It doesn't document Docker or shellserver installation. See [[Operations grimoire/Eglide/Vault]] and [[Dev ~~Zone~~/Vault]].''		''This page currently documents Vault installed on complector as part of {{Ops file\|roles/vault/}}. It doesn't document Docker or shellserver installation. See [[Operations grimoire/Eglide/Vault]] and [[Dev zone/Vault]].''

	Hashicorp Vault allows to manage credentials and is currently used:		Hashicorp Vault allows to manage credentials and is currently used:

2025-09-12T21:58:10Z

← Older revision		Revision as of 21:58, 12 September 2025
Line 1:		Line 1:
	''This page currently documents Vault installed on complector as part of {{Ops file\|roles/vault/}}. It doesn't document Docker or shellserver installation. See [[Operations grimoire/Eglide/Vault]].''		''This page currently documents Vault installed on complector as part of {{Ops file\|roles/vault/}}. It doesn't document Docker or shellserver installation. See [[Operations grimoire/Eglide/Vault]] and [[Dev Zone/Vault]].''

	Hashicorp Vault allows to manage credentials and is currently used:		Hashicorp Vault allows to manage credentials and is currently used:

2025-09-02T16:52:06Z

Renew Vault HTTP certificates

← Older revision		Revision as of 16:52, 2 September 2025
Line 172:		Line 172:

	Based on current D2639 state (2023-01), you can do the following:		Based on current D2639 state (2023-01), you can do the following:
	* Has intermediate authority certificate expired?		* Has intermediate authority certificate expired? [old instructions, currently not valid anymore]
	** Web console: <code>write -format=json pki_vault/intermediate/generate/internal common_name="nasqueron.drake Intermediate Authority"</code>		** Web console: <code>write -format=json pki_vault/intermediate/generate/internal common_name="nasqueron.drake Intermediate Authority"</code>
	** At https://localhost:8200/ui/vault/~~settings~~/~~secrets~~/~~configure~~/~~pki_root~~/~~cert~~ you can use the sign intermediate button to sign it, don't forget to fill the following information:		** At https://localhost:8200/ui/vault/secrets/pki_vault/pki/roles/nasqueron-drake you can use the sign intermediate button to sign it, don't forget to fill the following information:
	*** CSR, pick from console the .data.csr output from JSON response		*** CSR, pick from console the .data.csr output from JSON response
	*** Format: pem_bundle		*** Format: pem_bundle

2025-01-02T13:42:45Z

Get an admin-level token

← Older revision		Revision as of 13:42, 2 January 2025
Line 130:		Line 130:
	ssh complector		ssh complector
	cd /opt/salt/nasqueron-operations		cd /opt/salt/nasqueron-operations
	~~git switch vault-self-service-token-policy~~
	sudo ./utils/vault/issue-admin-token.py		sudo ./utils/vault/issue-admin-token.py

	~~Once [https://devcentral.nasqueron.org/D3355 D3355]~~ has ~~been merged~~, ~~that would be usable from~~ the ~~main branch~~.		If Vault certificate has expired, add the `--insecure` argument.

	== Troubleshoot ==		== Troubleshoot ==

2024-10-26T20:32:20Z

← Older revision		Revision as of 20:32, 26 October 2024
Line 237:		Line 237:
	Changes:		Changes:
	</syntaxhighlight>		</syntaxhighlight>

			[[Category:Operations grimoire]]
			[[Category:Vault]]