Packer: [rfc] vault template function

[mwhooker]

It would be neat if packer could retrieve configuration variables straight from vault.

I think the best way to do this would be through a template function, such at {{vault path/to/key}}.

With that semantic information, we could also filter any values from vault from the logs.

We'd ideally not expose any vault client configuration through the packer template, and get it from the environment. I'm not sure we could support it otherwise.

[dtrac]

Any news on this one? Ideally we'd also like to store password secrets in vault (local admin/root passwords etc) and retrieve them directly.

[degilq]

hello any new on this one?

[degilq]

i can not retrive values from vault for use in packer

[lfarnell]

@degilq This functionality is not implemented yet. I think this will come at less of an expense once HCL support lands for Packer. Hope thats helps.

[tamsky]

@lfarnell what's the status of HCL support ? Any progress yet?

[ndobbs]

Vault support with packer is much needed in our environment. Any idea when HCL support will be introduced to packer? @lfarnell @tamsky

[SwampDragons]

It's definitely on our TODO list but we have no timeline for you. Sorry.

[tomerleib]

Any news on this needed integration?

[SwampDragons]

It's penciled into our roadmap for later this year; won't likely be within the next few months. We'll update the ticket when we start work on it.

[jamesalbert]

[falzm]

Hi

At my employer we would be able to dedicate some time working in this feature. We imagine 2 different implementation scenarios:

• A naive one, where Vault support would be implemented straight as a {{vault /path/to/key}} template function as suggested by @mwhooker. Vault client settings (i.e. Vault URL, token...) would be inferred by the Go api package using environment variables, and only one Vault instance could be used at a time.
• A more complex one, where we would introduce a whole new generic "datastore" (name up to debate) abstraction allowing users to query remote key/value data storage systems – including Vault – similar to Terraform data sources, and to use retrieved values as variables in the rest of the Packer configuration. A modular plug-in based design could allow various backends to be used.

WDYT?

[routelastresort]

https://github.com/hashicorp/envconsul solves this, although it would be cool to have total integration

[mschuchard]

@degilq This functionality is not implemented yet. I think this will come at less of an expense once HCL support lands for Packer. Hope thats helps.

Terraform 0.12 HCL configuration has an exact 1:1 mapping to and from JSON.

So, does the new HCL bode well for this new feature?

[SwampDragons]

Can anyone test out the PR at https://github.com/hashicorp/packer/pull/6533 ?

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.