Discovers and opens a local TCP tunnel to a Vault cluster's primary instance. Useful as a "sidecar"/"companion app" when using the Terraform Vault provider.
All resources are available as Go library imports.
Roles required
- roles/compute.viewer
Basic
# This is enough when running vault-discover from GCP
export GOOGLE_PROJECT=some-gcp-project
export TAG_INSTANCE_FILTER=vault
vault-discoveryAdvanced
export GOOGLE_PROJECT=some-gcp-project
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/gcp/serviceaccount/token
export NAME_INSTANCE_FILTER=vault-
vault-discovery- Vault cluster GCE discovery:
- instances labels
- instances tags
- instances name (blob expression prefix)
Environment variables
| provider | variable name | required | default | description |
|---|---|---|---|---|
| DISCOVERY_PROVIDER | no | GCE | For now, only the "GCE" provider is available. | |
| TLS_SKIP_VERIFY | no | false | Whether to skip or not Vault endpoint certificate. | |
| gce | GCE_DEBUG | no | false | Whether to enable gcloud stdout/stderr |
| gce | GOOGLE_PROJECT | yes | Name of the GCP project to look for instances. | |
| gce | GOOGLE_APPLICATION_CREDENTIALS | no | Should not be needed when running from GCP. | |
| gce | NAME_INSTANCE_FILTER | no | Blob expression prefix to filter instances (example: 'vault-' == 'vault-*'). | |
| gce | LABEL_INSTANCE_FILTER | no | Single instance label value to filter instances. | |
| gce | TAG_INSTANCE_FILTER | no | Single instance tag value to filter instances. |
- Vault CA import
- Kubernetes discovery
- CLI configuration flags
- Unit tests
- Acceptance tests
- Exposing an interface{} API contract for new discovery providers
- Get rid of the 'gcloud' tool dependency for the GCE provider (publish a library for creating GCP IAP tunnels?)
Requires go 1.13
GOOS=linux go build -mod=readonly -ldflags="-s -w" -o vault-discoveryImplementing new providers (kubernetes?) would only require to introduce a new Go package exposing a public getter function returning a (types.VaultTunnelCon, error) tuple (pending an interface{} API contract).