Secret managers

Functions of the tools module at v0.5.0. Each returns what a command runs in; import it with import * as tools from "tools".

vault.env

The Vault CLI, hashicorp/vault:1.21.4 by default.

vault.env(
  --image: Environment = #hashicorp/vault:1.21.4,
  --addr: String | Null = null,
  --token: String | Null = <secret>,
  --namespace: String | Null = null,
  --skip_verify: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #hashicorp/vault:<tag>.
• --addr VAULT_ADDR.
• --token!! VAULT_TOKEN; masked in the command log.
• --namespace VAULT_NAMESPACE.
• --skip_verify VAULT_SKIP_VERIFY.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "vault" } on ... or $[...].

Image hashicorp/vault:1.21.4

lask eval vault.env --addr https://vault.example.com:8200

lib/vault.lask

vault.setup

What Vault clients read to reach a server: the vault CLI, the Terraform vault provider, most SDKs. Give it to another tool's --with.

vault.setup(
  --addr: String | Null = null,
  --token: String | Null = <secret>,
  --namespace: String | Null = null,
  --skip_verify: String | Null = null
): Record<env: Map<String>, volumes: Array<String>>

Parameters

• --addr VAULT_ADDR.
• --token!! VAULT_TOKEN; masked in the command log.
• --namespace VAULT_NAMESPACE, for Vault Enterprise or HCP.
• --skip_verify VAULT_SKIP_VERIFY: "true" to accept a certificate the container cannot verify.

Returns Record<env: Map<String>, volumes: Array<String>>: The variables, for a tool's --with.

lib/vault.lask

sops.env

SOPS, ghcr.io/getsops/sops:v3.13.3-alpine by default.

sops.env(
  --image: Environment = #ghcr.io/getsops/sops:v3.13.3-alpine,
  --age_key: String | Null = <secret>,
  --age_key_file: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

An age key is given here; a cloud KMS key takes that cloud's setup through --with: aws_setup, gcloud_setup, azure_setup, vault_setup.

Parameters

• --image The image to run; another release is passed as image = #ghcr.io/getsops/sops:<tag>.
• --age_key!! SOPS_AGE_KEY, the private key itself; masked in the command log.
• --age_key_file Host path of an age key file, mounted read-only at /run/secrets/age-key.txt (SOPS_AGE_KEY_FILE).
• --with Setups of other tools this environment should also carry: a KMS's credentials.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "sops" } on ... or $[...].

Image ghcr.io/getsops/sops:v3.13.3-alpine

lask eval sops.env --age_key_file /home/me/.config/sops/age/keys.txt

lib/sops.lask

op.env

The 1Password CLI, 1password/op:2.39.0 by default.

op.env(
  --image: Environment = #1password/op:2.39.0,
  --service_account_token: String | Null = <secret>,
  --connect_host: String | Null = null,
  --connect_token: String | Null = <secret>,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

A container cannot reach the desktop app's integration: authenticate with a service account token, or with a Connect server.

Parameters

• --image The image to run; another release is passed as image = #1password/op:<tag>.
• --service_account_token!! OP_SERVICE_ACCOUNT_TOKEN; masked in the command log.
• --connect_host OP_CONNECT_HOST.
• --connect_token!! OP_CONNECT_TOKEN; masked in the command log.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "op" } on ... or $[...].

Image 1password/op:2.39.0

lask eval op.env

lib/op.lask