anouvel/politree

A simple script to generate tree based on Hashicorp Vault policies.

Politree

A Ruby gem to generate a tree view of your HCL Vault policies files.

This project is really in an earlier development phase, please feel free to contribute, share or submit your ideas!

Installation

Add this line to your application's Gemfile:

gem 'politree'

And then execute:

$ bundle

Or install it yourself as:

$ gem install politree

Usage

# Create a exemple file
$ cat > exemple.hcl << EOL
# Allow tokens to look up their own properties
path "auth/token/lookup-self" {
    capabilities = ["read"]
}

# Allow tokens to renew themselves
path "auth/token/renew-self" {
    capabilities = ["update"]
}

# Allow tokens to revoke themselves
path "auth/token/revoke-self" {
    capabilities = ["update"]
}

# Allow a token to look up its own capabilities on a path
path "sys/capabilities-self" {
    capabilities = ["update"]
}

# Allow a token to renew a lease via lease_id in the request body; old path for
# old clients, new path for newer
path "sys/renew" {
    capabilities = ["update"]
}
path "sys/leases/renew" {
    capabilities = ["update"]
}

# Allow looking up lease properties. This requires knowing the lease ID ahead
# of time and does not divulge any sensitive information.
path "sys/leases/lookup" {
    capabilities = ["update"]
}

# Allow a token to manage its own cubbyhole
path "cubbyhole/*" {
    capabilities = ["create", "read", "update", "delete", "list"]
}

# Allow a token to wrap arbitrary values in a response-wrapping token
path "sys/wrapping/wrap" {
    capabilities = ["update"]
}

# Allow a token to look up the creation time and TTL of a given
# response-wrapping token
path "sys/wrapping/lookup" {
    capabilities = ["update"]
}

# Allow a token to unwrap a response-wrapping token. This is a convenience to
# avoid client token swapping since this is also part of the response wrapping
# policy.
path "sys/wrapping/unwrap" {
    capabilities = ["update"]
}

# Allow general purpose tools
path "sys/tools/hash" {
	capabilities = ["update"]
}
path "sys/tools/hash/*" {
	capabilities = ["update"]
}
path "sys/tools/random" {
	capabilities = ["update"]
}
path "sys/tools/random/*" {
	capabilities = ["update"]
}
EOL

# Run the generate command
$ politree generate example.hcl

And get a nice picture of your paths!

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Runtime Dependencies

• rgl
• rhcl
• thor

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/anouvel/vault_tree_generator. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

License

The gem is available as open source under the terms of the MIT License.

Code of Conduct

Everyone interacting in the Politree project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.

politree's Issues

Add capabilities for path

Can we add capabilities for each path ?