> For the complete CircleCI developer hub index, see [llms.txt](https://circleci.com/developer/llms.txt)

# smaeda-ks/orb-hashicorp-vault-cli

Provide commands to install HashiCorp Vault binary and obtain a token by authenticating with Vault using OIDC.

Supports Linux x86_64/Arm64-V8, and MacOS (Amd64).


## Commands

### auth-oidc

Authenticate with Vault using OIDC and obtain a token.
Upon successful authentication, the obtained token will be set to the VAULT_TOKEN environment variable using $BASH_ENV.


| Parameter | Type | Default | Description |
|---|---|---|---|
| `vault-address` | string |  | Vault address (e.g., https://127.0.0.1:8200) |
| `vault-auth-mount-path` | string | auth/jwt | The mount path of the auth backend to be used |
| `vault-namespace` | string |  | The Vault namespace to use |
| `vault-role` | string |  | The role name of the JWT/OIDC auth backend |
| `vault-tls-skip-verify` | boolean | false | Disable verification of TLS certificates. Using this option is highly
discouraged as it decreases the security of data transmissions to and
from the Vault server.
 |

### install

Install Vault binary

| Parameter | Type | Default | Description |
|---|---|---|---|
| `install-dir` | string | ~/bin | Directory in which to install vault |
| `version` | string | latest | Select a specific version of the Vault binary (e.g., "1.10.0"). By default the latest version will be used. |

### revoke-self

Revoke a Token (Self).
This command attempts to revoke the token set to the `VAULT_TOKEN` environment variable against the Vault instance set to the `VAULT_ADDR` environment variable. These environment variables are assumed to be already set by the `auth-oidc` command in the previous steps. When the token is revoked, all dynamic secrets generated with it are also revoked.


## Examples

### auth-oidc

Install Vault binary, authenticate using OIDC, and get secrets.


```yaml
version: '2.1'
orbs:
  orb-hashicorp-vault-cli: smaeda-ks/orb-hashicorp-vault-cli@0.1
jobs:
  my-job:
    machine: true
    steps:
      - checkout
      - orb-hashicorp-vault-cli/install
      - orb-hashicorp-vault-cli/auth-oidc:
          vault-address: http://localhost:8200
          vault-role: circleci-dev
      - run:
          command: |
            # export secret using $BASH_ENV
            # so it can be referenced by subsequent steps within the job
            FOO=$(vault kv get -field=foo secret/circleci/orb)
            echo "export SECRET_FOO=${FOO}" >> $BASH_ENV
          name: Get secret
      - orb-hashicorp-vault-cli/revoke-self
workflows:
  use-my-orb:
    jobs:
      - my-job:
          context: my-context
```