![Go Report Card](https://goreportcard.com/badge/github.com/cloudtrust/vault-bridge)
Vault bridge
Vault bridge is a microservice that serves as a bridge between an application and Vault. The application can send the following requests to the vault bridge:
- write a key in Vault (in key/value secret backend)
- read a key (from the key/value secret backend)
- create a key (in the transit backend) and export it
- encrypt a plaintext and decrypt a ciphertext (with keys from the transit backend)
Launch
./scripts/build.sh --env <value>
./bin/vaultBridge
When you launch the vault bridge, the parameters are read from conf/<value>/vault_bridge.yaml
.
For loading a different configuratiuon file launch the sevice with the following command:
./bin/vaultBridge --config-file "path/to/the/file.yaml".
Configuration
In order to run the service, you need to configure:
-
http address: the vault bridge listens to the http address given in the configuration file.
-
Vault: the Vault service needs to be set up. In order to communicate with Vault, the vault bridge needs to have a token and the address of Vault.
-
InfluxDB: the metrics will be send to an Influx time series DB. The service needs the url, username, password, db name of the DB and the table names where the metrics information is stored. Also it needs the parameters of the influxBatchPointsConfig.
-
Sentry: the errors and crashes are sent to a Sentry error tracking system. We need to provide the sentry DSN.
-
Jaeger: the tracing will be sent to Jaeger. The vault bridge needs to provide the Jaeger configuration parameters.
Usage
The vault bridge listens for http requests at different prefix paths, depending on the requests: /key
, /createkey
, /exportkey
, /encrypt
, /decrypt
.
Each http request must contain a JWT, the path and, if needed, data.
The parameters used in the http requests follow the Vault API.
Usage - examples
For these examples we work localhost and the vault bridge listens at port 8080.
read a key
curl -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiJyb2xleCIsImZpbCI6ImYxIn0.qt8lC6BOTVVx1RiEShpdgF43v1TAvTPGVdtL2rdixcc" localhost:8080/key/tenants/rolex/f1/key1
With this request, the microservice reads the key that is stored at tenants/rolex/f1/key1
.
write a key
curl -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiJyb2xleCIsImZpbCI6ImYxIn0.qt8lC6BOTVVx1RiEShpdgF43v1TAvTPGVdtL2rdixcc" -d'{"key":"abc"}' localhost:8080/key/tenants/rolex/f1/key1
With this request, the microservice writes the key/value {"key":"abc"}
at tenants/rolex/f1/key1
.
create a key
curl -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiJyb2xleCIsImZpbCI6ImYxIn0.qt8lC6BOTVVx1RiEShpdgF43v1TAvTPGVdtL2rdixcc" -d'{"params": {"type": "aes256-gcm96", "derived": false, "exportable": true}}' localhost:8080/createkey/key1
With this request, the microservice asks Vault to create an exportable
aes256-gcm96
key named key1
in the transit backend.
export a key
curl -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiJyb2xleCIsImZpbCI6ImYxIn0.qt8lC6BOTVVx1RiEShpdgF43v1TAvTPGVdtL2rdixcc" localhost:8080/exportkey/encryption-key/key100/1
With this request, the microservice fetches from Vault the key named key100
from the transit backend.
encrypt
curl -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiJyb2xleCIsImZpbCI6ImYxIn0.qt8lC6BOTVVx1RiEShpdgF43v1TAvTPGVdtL2rdixcc" -d'{"params": {"plaintext": "YWJjZA==", "key_version": 1}}' localhost:8080/encrypt/key100
With this request, the microservice asks Vault to encrypt the plaintext (base64 encoded) YWJjZA==
with the key named key100
from the transit backend.
decrypt
curl -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnQiOiJyb2xleCIsImZpbCI6ImYxIn0.qt8lC6BOTVVx1RiEShpdgF43v1TAvTPGVdtL2rdixcc" -d'{"params": {"ciphertext": "vault:v1:dKG1C2bFFdLMJQkau6v3lDmhHfLtTMBB9cd0XBy6Id8="}}' localhost:8080/decrypt/key100
With this request, the microservice asks Vault to decrypt the ciphertext (base64 encoded) vault:v1:dKG1C2bFFdLMJQkau6v3lDmhHfLtTMBB9cd0XBy6Id8=
with the key named key100
from the transit backend.