Skip to content

Commit

Permalink
Vault: documentation update (#104)
Browse files Browse the repository at this point in the history
Vault: documentation update

Updated documentation includes:

demo.rst
api.md
usage.rst
README.md
vault_configure.tf

Reviewed-by: Anton Sidelnikov <None>
Reviewed-by: Aloento <None>
  • Loading branch information
artem-lifshits authored Aug 23, 2022
1 parent 9f567c6 commit 61a3faf
Show file tree
Hide file tree
Showing 5 changed files with 14 additions and 14 deletions.
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,8 @@ You must have a Vault server already running, unsealed, and authenticated.
1. Firstly you have to define an admin credentials in a cloud.

```sh
$ vault write /openstack/cloud/example-cloud auth_url=https://127.0.0.1/v3/ username=admin password=admin user_domain_name=mydomain
Success! Data written to: openstack/cloud/example-cloud
$ vault write /openstack/clouds/example-cloud auth_url=https://127.0.0.1/v3/ username=admin password=admin user_domain_name=mydomain
Success! Data written to: openstack/clouds/example-cloud
```

> **_NOTE:_** In the `cloud` you can specify additional parameters such as [`username_template`](https://www.vaultproject.io/docs/concepts/username-templating)
Expand All @@ -72,8 +72,8 @@ You must have a Vault server already running, unsealed, and authenticated.
1. After that you need to create a role for the cloud.

```sh
$ vault write /openstack/role/example-role cloud=example-cloud project_name=myproject domain_name=mydomain user_roles="member" root=false
Success! Data written to: openstack/role/example-role
$ vault write /openstack/roles/example-role cloud=example-cloud project_name=myproject domain_name=mydomain user_roles="member" root=false
Success! Data written to: openstack/roles/example-role
```

1. Now you can easily create a temporary user/token pair.
Expand Down
2 changes: 1 addition & 1 deletion doc/source/api.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ $ curl \

## Read Root Configuration

This endpoint allows you to read non-secure values that have been set in the `cloud/:cloud` endpoint.
This endpoint allows you to read non-secure values that have been set in the `clouds/:cloud` endpoint.
In particular, the `password` parameter is never returned.

| Method | Path |
Expand Down
4 changes: 2 additions & 2 deletions doc/source/examples/demo.rst
Original file line number Diff line number Diff line change
Expand Up @@ -53,13 +53,13 @@ perform invoke Terraform to query image_id for the image by name.

.. code-block::
$ vault write openstack/cloud/demo auth_url=https://<AUTH_URL> username=<USER> password=<PASSWORD> user_domain_name=<USER_DOMAIN_NAME> password_policy=os-policy
$ vault write openstack/clouds/demo auth_url=https://<AUTH_URL> username=<USER> password=<PASSWORD> user_domain_name=<USER_DOMAIN_NAME> password_policy=os-policy
- Configure root token role

.. code-block:: console
$ vault write /openstack/role/root_token cloud=demo project_name=<PROJECT_NAME> domain_name=<DOMAIN_NAME> root=true
$ vault write /openstack/roles/root_token cloud=demo project_name=<PROJECT_NAME> domain_name=<DOMAIN_NAME> root=true
- Prepare Terraform configuration

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ resource "vault_generic_secret" "os_policy" {
}

resource "vault_generic_secret" "os_root" {
path = "openstack/cloud/os_root"
path = "openstack/clouds/os_root"

data_json = file("${path.cwd}/vault_data/os_root.json")

Expand All @@ -15,7 +15,7 @@ resource "vault_generic_secret" "os_root" {
}

resource "vault_generic_secret" "tmp_user_token" {
path = "openstack/role/tmp_user_token"
path = "openstack/roles/tmp_user_token"

data_json = file("${path.cwd}/vault_data/tmp_user_token.json")

Expand All @@ -25,7 +25,7 @@ resource "vault_generic_secret" "tmp_user_token" {
}

resource "vault_generic_secret" "root_token" {
path = "openstack/role/root_token"
path = "openstack/roles/root_token"

data_json = file("${path.cwd}/vault_data/root_token.json")

Expand Down
8 changes: 4 additions & 4 deletions doc/source/usage.rst
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ will give possibility to use dynamic roles for requesting a temporary user.

.. code-block:: console
$ vault write /openstack/cloud/example-cloud auth_url=https://127.0.0.1/v3/ username=admin password=admin user_domain_name=mydomain username_template= vault{{random 8 | lowercase}} password_policy=my-policy
$ vault write /openstack/clouds/example-cloud auth_url=https://127.0.0.1/v3/ username=admin password=admin user_domain_name=mydomain username_template= vault{{random 8 | lowercase}} password_policy=my-policy
Success! Data written to: openstack/cloud/example-cloud
Roles
Expand All @@ -25,21 +25,21 @@ To configure a role that generates OSC Service Account token (preferred):

.. code-block:: console
$ vault write /openstack/role/role-tmp-user cloud=example-cloud project_name=myproject domain_name=mydomain user_groups=power-user root=false secret_type=token
$ vault write /openstack/roles/role-tmp-user cloud=example-cloud project_name=myproject domain_name=mydomain user_groups=power-user root=false secret_type=token
Success! Data written to: openstack/role/role-tmp-user
To configure a role that generates OSC Service Account password:

.. code-block:: console
$ vault write /openstack/role/role-tmp-user-pwd cloud=example-cloud project_name=myproject domain_name=mydomain user_groups=power-user root=false secret_type=password
$ vault write /openstack/roles/role-tmp-user-pwd cloud=example-cloud project_name=myproject domain_name=mydomain user_groups=power-user root=false secret_type=password
Success! Data written to: openstack/role/role-tmp-user-pwd
To configure a role that generates OSC root account token

.. code-block:: console
$ vault write /openstack/role/role-root-user cloud=example-cloud project_name=myproject domain_name=mydomain root=true
$ vault write /openstack/roles/role-root-user cloud=example-cloud project_name=myproject domain_name=mydomain root=true
Success! Data written to: openstack/role/role-root-user
After the secrets engine is configured and a user/machine has a Vault token
Expand Down

0 comments on commit 61a3faf

Please sign in to comment.