In Preview: Hashicorp Vault Plugin for Netbox

[mraerino]

Hey folks!

I started working on a closer integration of Vault into Netbox as a plugin and have a first working version ready.

The code and docs can be found at: https://github.com/ffddorf/netbox-vault-secrets
There is an experimental release published at: https://github.com/ffddorf/netbox-vault-secrets/releases/tag/v0.0.1-alpha1

I would love your feedback on the usefulness of this and what features you'd need to run this as part of your production deployments. Feel free to create issues or comment here!

cc some people that have talked about this before: @n3bojs4 @DanSheps @jameskirsop

[n3bojs4]

Hello Marcus !
This is a greet news, i'll test your module very quickly. Thanks for your work !

[jeremystretch]

Very cool! This is something I've been wanting to try and just haven't had the time. Will try to dig into this soon and see if I can be of any help.

[DanSheps]

Unfortunately I don't run Hashicorp (we use Thycotic), but from the one SS, it looks great.

Is it mainly client side?

[mraerino]

Is it mainly client side?

yes, it's a minimal preact app talking to vault.
the python code just inserts an empty diff and some json as metadata for the JS to pick up

[DanSheps]

Cool, I will take a look as again I use Thycotic and we have a need for it.

[mraerino]

if you think both solutions are close enough to use the same data model it could make sense to make the plugin usable with both

[DanSheps]

I will let you know.

[n3bojs4]

Hello Marcus, I opened a ticket regarding the plugin, do you have any clue : ffddorf/netbox-vault-secrets#7 Thanks in advance. Regards. Le dim. 5 déc. 2021 à 23:18, Marcus Weiner ***@***.***> a écrit :

…

Hey folks! I started working on a closer integration of Vault into Netbox as a plugin and have a first working version ready. The code and docs can be found at: https://github.com/ffddorf/netbox-vault-secrets There is an experimental release published at: https://github.com/ffddorf/netbox-vault-secrets/releases/tag/v0.0.1-alpha1 I would love your feedback on the usefulness of this and what features you'd need to run this as part of your production deployments. Feel free to create issues or comment here! cc some people that have talked about this before: @n3bojs4 <https://github.com/n3bojs4> @DanSheps <https://github.com/DanSheps> @jameskirsop <https://github.com/jameskirsop> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#7980>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABMOAB7G5SAO4KB25OM64M3UPPQKPANCNFSM5JNISKNQ> .

[lukap357]

Love the plugin, would like to see login with LDAP.

[mraerino]

thanks for the feedback! i meant to look into more auth methods, but if you want guidance for a PR, i'm happy to help

[candlerb]

I think Vault is a great fit for this, especially with versioned secrets so you keep history of previous values.

Secrets are stored at paths per a simple convention:

/device/{id}/{slug} for Devices
/vm/{id}/{slug} for Virtual Machines
/service/{id}/{slug} for Services

If I understand this correctly, then this means e.g. /secret/device/42/snmp-community in Vault.

What I'd really like is a layer of indirection, so that I could share the same secret across multiple devices and/or VMs. For example, on a particular device I could set the snmp-community secret to "prod1", and then lookup /secret/snmp-community/prod1 in Vault to retrieve the actual secret.

Having said that, I could probably get away with just a custom field on Device for that. But there are also some cases where there are unique secrets per device.

The plugin uses Javascript in the browser to access the Vault API directly. Your Netbox installation will never have access to the secrets or authentication credentials in Vault.

That is sound, although what happens if the user is not currently logged into Vault? Does it redirect the user to the Vault web UI to login?

One other point: I remember seeing a FR before to add secrets to any type of object - in particular Racks and Sites (for the access codes). With a generic foreign key, that ought to be straightforward.

[davama]

Dont mean to necro bump but was hoping to try this out. It seems it has not been updated in a while. 😞

Got errors when i installed it via docker build

1.697 Traceback (most recent call last):
1.697   File "/opt/netbox/netbox/manage.py", line 10, in <module>
1.698     execute_from_command_line(sys.argv)
1.698   File "/opt/netbox/venv/lib/python3.12/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line
1.698     utility.execute()
1.698   File "/opt/netbox/venv/lib/python3.12/site-packages/django/core/management/__init__.py", line 416, in execute
1.699     django.setup()
1.699   File "/opt/netbox/venv/lib/python3.12/site-packages/django/__init__.py", line 24, in setup
1.699     apps.populate(settings.INSTALLED_APPS)
1.699   File "/opt/netbox/venv/lib/python3.12/site-packages/django/apps/registry.py", line 93, in populate
1.699     raise ImproperlyConfigured(
1.699 django.core.exceptions.ImproperlyConfigured: Application labels aren't unique, duplicates: netbox_branching

[candlerb]

django.core.exceptions.ImproperlyConfigured: Application labels aren't unique, duplicates: netbox_branching

Try installing without the netbox_branching plugin. I can't see what this has to do with Vault and/or netbox_secrets.

[mraerino]

sorry, the plugin has not been updated for the current version of netbox. 4.x changed a lot about how plugins have to be authored. if there is real interest i can look into making the change.

[davama]

Yes, there’s interest (prob not only one) if not too much to ask 🙇
Thank you!

[mraerino]

i will look into it on the weekend.

if anybody wants to make a PR, here is the official guide on how to migrate plugins: https://netboxlabs.com/docs/netbox/en/stable/plugins/development/migration-v4/