https://github.com/vito/vaultchuck
migrates a concourse pipeline from static credentials to vault
https://github.com/vito/vaultchuck
Last synced: over 1 year ago
JSON representation
migrates a concourse pipeline from static credentials to vault
- Host: GitHub
- URL: https://github.com/vito/vaultchuck
- Owner: vito
- License: mit
- Created: 2017-06-27T15:33:14.000Z (about 9 years ago)
- Default Branch: master
- Last Pushed: 2017-06-27T16:01:37.000Z (about 9 years ago)
- Last Synced: 2025-03-25T12:41:14.329Z (over 1 year ago)
- Language: Go
- Size: 2.93 KB
- Stars: 9
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# vaultchuck
A one-off tool to ease migration from static credentials to Vault.
## usage
First, copy your current pipeline config to a file, like `pipeline-old.yml`.
Second, manually change the parameters in your pipeline config to how you want
them to look with vault. For example, you may change...:
```yaml
- name: concourse-docs
type: cf
source:
api: ((cf-target))
username: ((cf-username))
password: ((cf-password))
organization: ((cf-organization))
space: ((cf-space))
```
...to...:
```yaml
- name: concourse-docs
type: cf
source:
api: ((docs_cf.target))
username: ((docs_cf.username))
password: ((docs_cf.password))
organization: ((docs_cf.organization))
space: ((docs_cf.space))
```
Then, place your old params file somewhere on disk (ideally `/tmp`), and run:
```sh
vaultchuck --before pipeline-old.yml --after pipeline.yml --params /tmp/params.yml
```
You can pass `--dry-run` to see what it'll try to write (excluding the
credentials).
This will diff the pipelines, and at each delta, use the old pipeline to fetch
the credential, and use the new pipeline to determine where to build it.
Once all the new keys and fields are collected, it will write each one to
Vault. You can then commit and push your new pipeline.