https://github.com/kcq/poc-strongswan-vault-psk-loader
A very basic PoC to show loading StrongSwan PSKs from Vault
https://github.com/kcq/poc-strongswan-vault-psk-loader
golang strongswan vault
Last synced: 6 months ago
JSON representation
A very basic PoC to show loading StrongSwan PSKs from Vault
- Host: GitHub
- URL: https://github.com/kcq/poc-strongswan-vault-psk-loader
- Owner: kcq
- Created: 2019-01-14T09:49:47.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2019-01-14T19:28:41.000Z (almost 7 years ago)
- Last Synced: 2025-03-25T15:13:42.444Z (7 months ago)
- Topics: golang, strongswan, vault
- Language: Go
- Size: 10.7 KB
- Stars: 6
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# PoC - Vault PSK Loader for StrongSwan
## PoC Overview
The PoC adds three PSKs to StrongSwan (a static PSK and two PSKs from Vault when it detects those new PSKs).
The PoC service runs until it adds two PSKs it discovers in Vault.
## PSK Loader Service
The service lists the current PSKs (their IDs) whenever it adds a new PSK to verify that StrongSwan knows about it. Note that the PSKs loaded through other interfaces will not be visible (including the PSKs defined in the StrongSwan config files).
## Docker Compose Notes
* Run `dc_build.command` to build the components
* Run `dc_run.command` to run the PoC components (and watch the console output)
* Run `dc_cleanup.command` once you are done (after each PoC execution)
## Add Two PSKs to Vault
Once the PoC containers are up and running it's time to add new PSKs (using Vault UI and API).
Create a PSK through the Vault UI (login with token: `poc-vault-token`). Use the following Create Secret fields:
* Path for this section: `psk/one` (`psk` - path prefix, `one` - key name)
* Version Data (field key value): `name` -> `psk.name.one` , `value` -> `psk.value.one`
Add another PSK using the helper script (`vault_add_psk_two.command`).
## Notes
* Need a recent version of StrongSwan because the ability to load PSKs was not a part of the original version of the Vici interface/plugin.
* The PSK discovery process is pretty basic. A real Vault secret notification implementation is not in scope.