Vault Service for the Moleculer framework

This Services provides actions for communicating with a Vault Server. Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, or certificates. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log. The goal of this package is to provide actions for accessing and managing secrets using a connected vault server.

Features

The following List details which features are implemented

• Connect to the Vault on startup
• Obtain the health status of the Vault
• Mount Management
• Write, Read and Delete Secrets from the Vault

Roadmap

The following List details which features will potentially be implemented

• Seal and Unseal the Vault
• Audit Management
• Auth Management
• Policy Management

Install

This package is available in the npm-registry. In order to use it simply install it with yarn (or npm):

yarn add moleculer-vault

Usage

To make use of this Service, simply require it and create a new service:

let { ServiceBroker } = require("moleculer");
let VaultService = require("moleculer-vault");

let broker = new ServiceBroker({ logger: console });

// Create a service
broker.createService({
    mixins: VaultService,
    settings: {
        endpoint: "http://my-vault:8200",
    }
});

// Start server
broker.start().then(() => broker.call('vault.health'));

For a more indepth example checkout out the examples folder. It includes a docker-compose file, running docker-compose up will boot a broker with a vault service and a vault server. All vault service actions are exposed on the API (which you should never do in real live!!!). You can run curl http://localhost:3000/vault/health for example. This project includes a published postman collection enabling you to quickly explore the service in your local environment.

Settings

Property	Type	Default	Description
apiVersion	String	required	Which API Version of the Vault to use.
endpoint	String	required	Where to find the Vault.
token	String	null	Which token to use for authenticating against the Vault
waitForInitializationAttempts	Number	required	When starting, the service will connect to the Vault. When the Vault is not initialized, it will by default request the initialization status up to 5 times
waitForInitializationInterval	Number	required	When starting, the service will connect to the Vault. When the Vault is not initialized, it will by wait for 1 second before requesting the initialization status again

Actions

health

Obtain the Vaults Health.

Parameters

Property	Type	Default	Description
No input parameters.

Results

Type: Object

The Vaults Health Status.

mounts

Obtain all mounts of the Vault

Parameters

Property	Type	Default	Description
No input parameters.

Results

Type: Array.<Object>

mount

Mount a new secret store at a given path

Parameters

Property	Type	Default	Description
mount_point	String	required	Specifies the path where the secrets engine will be mounted.
type	String	required	Specifies the type of the backend, such as "aws".
description	String	-	Specifies the human-friendly description of the mount.
config	Object	-	Specifies configuration options for this mount.
options	Object	-	Specifies mount type specific options that are passed to the backend.
local	Boolean	false	ENTERPRISE ONLY: Specifies if the secrets engine is a local mount only. Local mounts are not replicated nor (if a secondary) removed by replication.
seal_wrap	Boolean	false	ENTERPRISE ONLY: Enable seal wrapping for the mount.

Results

Type: undefined

remount

Remount a mount to a different Path

Parameters

Property	Type	Default	Description
from	String	required	Specifies the previous mount point.
to	String	required	Specifies the new destination mount point.

Results

Type: undefined

unmount

Unmount a mount from a path

Parameters

Property	Type	Default	Description
mount_point	String	required	Specifies the path where the secrets engine will be mounted.

Results

Type: undefined

write

Write data to a Vault Backend

Parameters

Property	Type	Default	Description
path	String	required	Specifies the path to write to
data	Object	required	The data to write. Schema of this object

    depends on the backend that is mounted at the given path |

| requestOptions | Object | - | Additional request Options that are passed to the request-promise-native underneath |

Results

Type: Object

Schema depends on the backend that is mounted at the given path

read

Write data from a Vault Backend

Parameters

Property	Type	Default	Description
path	String	required	Specifies which data to read
requestOptions	Object	-	Additional request Options that

    are passed to the request-promise-native underneath |

Results

Type: Object

Schema depends on the backend that is mounted at the given path

list

List data from a Vault Backend

Parameters

Property	Type	Default	Description
path	String	required	Specifies which data to list
requestOptions	Object	-	Additional request Options that

    are passed to the request-promise-native underneath |

Results

Type: Object

Schema depends on the backend that is mounted at the given path

delete

Delete data from a Vault Backend

Parameters

Property	Type	Default	Description
path	String	required	Specifies which data to read
requestOptions	Object	-	Additional request Options that

    are passed to the request-promise-native underneath |

Results

Type: Object

Schema depends on the backend that is mounted at the given path

help

Obtain help from a Vault Backend

Parameters

Property	Type	Default	Description
path	String	required	Specifies for what to obtain help
requestOptions	Object	-	Additional request Options that

    are passed to the request-promise-native underneath |

Results

Type: Object

Schema depends on the backend that is mounted at the given path

Test

$ docker-compose exec package yarn test

In development with watching

$ docker-compose up

License

moleculer-vault is available under the MIT license.