Javascript client for HashiCorp's Vault
npm install node-vault





A client for the HTTP API of HashiCorp's [Vault] written for Node.js.
16.0.0``bash`
npm install -S node-vault
> The year is 2023; If, for whatever reason, you need to use an older version of node.js (yet still >= 6.x), use node-vault <= v0.10.0node-vault <= v0.10.0
>
> Please note that contains multiple vulnerabilities ☠️
Run tests using docker-compose (includes vault, postgres and running the tests inside) with:
`bash`
docker-compose up --force-recreate test
`javascript
var options = {
apiVersion: 'v1', // default
endpoint: 'http://127.0.0.1:8200', // default
token: 'MY_TOKEN' // optional client token; can be fetched after valid initialization of the server
};
// get new instance of the client
var vault = require("node-vault")(options);
// init vault server
vault.init({ secret_shares: 1, secret_threshold: 1 })
.then( (result) => {
var keys = result.keys;
// set token for all following requests
vault.token = result.root_token;
// unseal vault server
return vault.unseal({ secret_shares: 1, key: keys[0] })
})
.catch(console.error);
`
`javascript`
vault.write('secret/hello', { value: 'world', lease: '1s' })
.then( () => vault.read('secret/hello'))
.then( () => vault.delete('secret/hello'))
.catch(console.error);`$3
javascript
//if vault kubernets endpoint is /auth/example-cluster/login and role is example-role
//read token from default token mount path
const token = await fs.readFileSync('/var/run/secrets/kubernetes.io/serviceaccount/token', { encoding: 'utf8' });
vault.kubernetesLogin({role: 'example-role' ,
jwt: token,
kubernetesPath: 'example-cluster'})
`
.
Examples
Please have a look at the [examples] and the generated [feature list] to see what is already implemented.Instead of installing all the dependencies like vault itself, postgres and other stuff you can
use [docker] and [docker-compose] to link and run multiple docker containers with all of its dependencies.
`bash
git clone git@github.com:nodevault/node-vault.git
cd node-vault
docker-compose up vault
`Now you can run the examples from another terminal window.
First of all you should initialize and unseal the vault:
`bash
node example/init.js
`
You should see root_token: followed by a long key in the response.
Please copy that long key and export it as environment variable:
`bash
export VAULT_TOKEN=
`Now you are able to run all of the other [examples]:
`bash
node example/policies.js
`Connecting to vault through a bastion host
To connect to a vault server in a private network with a bastion host, you'll need to first open a connection:
`bash
ssh -D bastion.example.com
``javascript
const SocksProxyAgent = require('socks-proxy-agent');
const agent = new SocksProxyAgent(socks://127.0.0.1:${socks4Port}, true);
const options = {
apiVersion: 'v1',
rpOptions: {
agent,
},
};const vault = require('node-vault')(options);
``
[examples]: https://github.com/nodevault/node-vault/tree/master/example
[docker-compose.yml]: https://github.com/nodevault/node-vault/tree/master/docker-compose.yml
[Vault]: https://vaultproject.io/
[docker-compose]: https://www.docker.com/docker-compose
[docker]: http://docs.docker.com/
[docker toolbox]: https://www.docker.com/toolbox
[docco]: http://jashkenas.github.io/docco
[feature list]: https://github.com/nodevault/node-vault/tree/master/features.md