vkv

README

vkv

Description

vkv recursively list you all key-value entries from Vaults KV2 secret engine in various formats. vkv flags can be devided into input, modifying and output format flags.

So far vkv offers:

Input flags

• -p | --paths: KV mount paths (comma separated list for multiple paths) (env: VKV_PATHS, default: kv)

Modifying flags

• --only-keys: show only keys (env: VKV_ONLY_KEYS, default: false)
• --only-paths: show only paths (env: VKV_ONLY_PATHS, default: false)
• --show-values: dont mask values (env: VKV_SHOW_VALUES, default: false)
• --max-value-length: maximum char length of values (set to -1 for disabling) (env: VKV_MAX_VALUE_LENGTH, default: 12)
• --template-file: path to a file containing Go-template syntax to render the KV entries (env: VKV_TEMPLATE_FILE)
• --template-string: string containting Go-template syntax to render KV entries (env: VKV_TEMPLATE_STRING)

Output Flags (see Supported Formats)

• -f | --format: output format (options: base, yaml, json, export, markdown, template) (env: "VKV_FORMAT", default: "base")

⚠️ A flag always preceed its environment variable

You can combine most of those flags in order to receive the desired output.

Installation

Find the corresponding binaries, .rpm and .deb packages in the release section.

Supported OS and Vault Versions

vkv is being tested on Windows, MacOS and Linux and also against Vault Version >= v1.8.0 (but it also may work with lower versions).

Authentication

vkv supports token based authentication. It is clear that you can only see the secrets that are allowed by your token policy.

All of vaults environment variables are supported. In order to authenticate to a Vault instance you have to set atleast VAULT_ADDR and VAULT_TOKEN:

# on linux/macos
VAULT_ADDR="http://127.0.0.1:8200" VAULT_TOKEN="s.XXX" vkv -p <kv-path>

# on windows
SET VAULT_ADDR=http://127.0.0.1:8200
SET VAULT_TOKEN=s.XXX
vkv.exe -p <kv-path>

Supported Formats

base	markdown
json	yaml

template