Sign inSign up

bmaximuml/vault_unsealer

By bmaximuml

•Updated about 4 years ago

Image
0

1.1K

bmaximuml/vault_unsealer repository overview

⁠Vault Unsealer

This is a docker image which can be used to unseal a Hashicorp vault.

This image should be given a single unseal key, and will continuously use it to attempt to unseal a given Hashicorp vault.

Multiple iterations of this image should be deployed for a single vault, with each container being given a different unseal key.

⁠Configuration

This image is configurable using the following environment variables.

⁠VAULT_ADDR

A URI for a hashicorp vault.

Example: http://vault.example.com:8200/

⁠UNSEAL_KEY

A key which can be used to unseal a hashicorp vault.

Example: 0O9QcJC+fwTJxbC0jalr3oPbPjBj1lAT4WIeGKgKOwen

⁠UNSEAL_KEY_FILE

A path to a file containing an unseal key.

Example: /run/secrets/unseal_key_1

⁠Deployment

⁠Standalone

docker run -d -e "VAULT_ADDR=http://vault.example.com:8200/" -e "UNSEAL_KEY=0O9QcJC+fwTJxbC0jalr3oPbPjBj1lAT4WIeGKgKOwen" bmaximuml/vault_unsealer

⁠Docker Service
⁠CLI

docker service create --name vault_unsealer_1 -e "VAULT_ADDR=http://vault.example.com:8200/" -e "UNSEAL_KEY=0O9QcJC+fwTJxbC0jalr3oPbPjBj1lAT4WIeGKgKOwen" bmaximuml/vault_unsealer

⁠Docker-Compose
version: "3.8"
services:
    vault_unsealer_1:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY: "0O9QcJC+fwTJxbC0jalr3oPbPjBj1lAT4WIeGKgKOwen"
⁠Docker Service with Docker Secrets

Docker secrets can only be used with Docker services, not standalone containers

⁠CLI
echo "0O9QcJC+fwTJxbC0jalr3oPbPjBj1lAT4WIeGKgKOwen" | docker secret create unseal_key_1 -
`docker service create --name vault_unsealer_1 -e "VAULT_ADDR=http://vault.example.com:8200/" -e "UNSEAL_KEY_FILE=/run/secrets/unseal_key_1" --secret unseal_key_1  bmaximuml/vault_unsealer`
⁠Docker-Compose

This assumes the unseal key is initially stored in a file /secrets/unseal_key_1 on the host.

version: "3.8"
services:
    vault_unsealer_1:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY_FILE: "/run/secrets/unseal_key_1"
        secrets:
            - unseal_key_1

secrets:
    unseal_key_1:
        file: /secrets/unseal_key_1
⁠Five Key Example

Here is an example docker-compose file to build out five containers, each with a different unseal key. Vault installations contain five unseal keys by default, with a quorum of three required to unseal the vault.

version: "3.8"
services:
    vault_unsealer_1:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY_FILE: "/run/secrets/unseal_key_1"
        secrets:
            - unseal_key_1
    vault_unsealer_2:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY_FILE: "/run/secrets/unseal_key_2"
        secrets:
            - unseal_key_2
    vault_unsealer_3:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY_FILE: "/run/secrets/unseal_key_3"
        secrets:
            - unseal_key_3
    vault_unsealer_4:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY_FILE: "/run/secrets/unseal_key_4"
        secrets:
            - unseal_key_4
    vault_unsealer_5:
        image: bmaximuml/vault_unsealer
        environment:
            VAULT_ADDR: "http://vault.example.com:8200/"
            UNSEAL_KEY_FILE: "/run/secrets/unseal_key_5"
        secrets:
            - unseal_key_5

secrets:
    unseal_key_1:
        file: /secrets/unseal_key_1
    unseal_key_2:
        file: /secrets/unseal_key_2
    unseal_key_3:
        file: /secrets/unseal_key_3
    unseal_key_4:
        file: /secrets/unseal_key_4
    unseal_key_5:
        file: /secrets/unseal_key_5

© Max Levine 2022

Tag summary

Content type

Image

Digest

Size

73.9 MB

Last updated

about 4 years ago

docker pull bmaximuml/vault_unsealer