airflow.providers.hashicorp.hooks.vault

Hook for HashiCorp Vault

Module Contents

class airflow.providers.hashicorp.hooks.vault.VaultHook(vault_conn_id: str = default_conn_name, auth_type: Optional[str] = None, auth_mount_point: Optional[str] = None, kv_engine_version: Optional[int] = None, role_id: Optional[str] = None, kubernetes_role: Optional[str] = None, kubernetes_jwt_path: Optional[str] = None, token_path: Optional[str] = None, gcp_key_path: Optional[str] = None, gcp_scopes: Optional[str] = None, azure_tenant_id: Optional[str] = None, azure_resource: Optional[str] = None, radius_host: Optional[str] = None, radius_port: Optional[int] = None)[source]

Bases: airflow.hooks.base.BaseHook

Hook to Interact with HashiCorp Vault KeyValue Secret engine.

HashiCorp hvac documentation:

You connect to the host specified as host in the connection. The login/password from the connection are used as credentials usually and you can specify different authentication parameters via init params or via corresponding extras in the connection.

The mount point should be placed as a path in the URL - similarly to Vault's URL schema: This indicates the "path" the secret engine is mounted on. Default id not specified is "secret". Note that this mount_point is not used for authentication if authentication is done via a different engines. Each engine uses it's own engine-specific authentication mount_point.

The extras in the connection are named the same as the parameters ('kv_engine_version', 'auth_type', ...).

You can also use gcp_keyfile_dict extra to pass json-formatted dict in case of 'gcp' authentication.

The URL schemas supported are "vault", "http" (using http to connect to the vault) or "vaults" and "https" (using https to connect to the vault).

Example URL:

vault://user:password@host:port/mount_point?kv_engine_version=1&auth_type=github

Login/Password are used as credentials:

  • approle: password -> secret_id

  • github: password -> token

  • token: password -> token

  • aws_iam: login -> key_id, password -> secret_id

  • azure: login -> client_id, password -> client_secret

  • ldap: login -> username, password -> password

  • userpass: login -> username, password -> password

  • radius: password -> radius_secret

Parameters

  • vault_conn_id (str) -- The id of the connection to use

  • auth_type (str) -- Authentication Type for the Vault. Default is token. Available values are: ('approle', 'github', 'gcp', 'kubernetes', 'ldap', 'token', 'userpass')

  • auth_mount_point (str) -- It can be used to define mount_point for authentication chosen Default depends on the authentication method used.

  • kv_engine_version (int) -- Select the version of the engine to run (1 or 2). Defaults to version defined in connection or 2 if not defined in connection.

  • role_id (str) -- Role ID for Authentication (for approle, aws_iam auth_types)

  • kubernetes_role (str) -- Role for Authentication (for kubernetes auth_type)

  • kubernetes_jwt_path (str) -- Path for kubernetes jwt token (for kubernetes auth_type, default: /var/run/secrets/kubernetes.io/serviceaccount/token)

  • token_path (str) -- path to file containing authentication token to include in requests sent to Vault (for token and github auth_type).

  • gcp_key_path (str) -- Path to Google Cloud Service Account key file (JSON) (for gcp auth_type) Mutually exclusive with gcp_keyfile_dict

  • gcp_scopes (str) -- Comma-separated string containing OAuth2 scopes (for gcp auth_type)

  • azure_tenant_id (str) -- The tenant id for the Azure Active Directory (for azure auth_type)

  • azure_resource (str) -- The configured URL for the application registered in Azure Active Directory (for azure auth_type)

  • radius_host (str) -- Host for radius (for radius auth_type)

  • radius_port (int) -- Port for radius (for radius auth_type)

conn_name_attr = vault_conn_id[source]
default_conn_name = imap_default[source]
conn_type = vault[source]
hook_name = Hashicorp Vault[source]
_get_kubernetes_parameters_from_connection(self, kubernetes_jwt_path: Optional[str], kubernetes_role: Optional[str])[source]
_get_gcp_parameters_from_connection(self, gcp_key_path: Optional[str], gcp_scopes: Optional[str])[source]
_get_azure_parameters_from_connection(self, azure_resource: Optional[str], azure_tenant_id: Optional[str])[source]
_get_radius_parameters_from_connection(self, radius_host: Optional[str], radius_port: Optional[int])[source]
get_conn(self)[source]

Retrieves connection to Vault.

Return type

hvac.Client

Returns

connection used.

get_secret(self, secret_path: str, secret_version: Optional[int] = None)[source]

Get secret value from the engine.

Parameters

  • secret_path (str) -- Path of the secret

  • secret_version (int) -- Optional version of key to read - can only be used in case of version 2 of KV

See https://hvac.readthedocs.io/en/stable/usage/secrets_engines/kv_v1.html and https://hvac.readthedocs.io/en/stable/usage/secrets_engines/kv_v2.html for details.

Parameters

secret_path (str) -- Path of the secret

Return type

dict

Returns

secret stored in the vault as a dictionary

get_secret_metadata(self, secret_path: str)[source]

Reads secret metadata (including versions) from the engine. It is only valid for KV version 2.

Parameters

secret_path (str) -- Path to read from

Return type

dict

Returns

secret metadata. This is a Dict containing metadata for the secret.

See https://hvac.readthedocs.io/en/stable/usage/secrets_engines/kv_v2.html for details.

get_secret_including_metadata(self, secret_path: str, secret_version: Optional[int] = None)[source]

Reads secret including metadata. It is only valid for KV version 2.

See https://hvac.readthedocs.io/en/stable/usage/secrets_engines/kv_v2.html for details.

Parameters

  • secret_path (str) -- Path of the secret

  • secret_version (int) -- Optional version of key to read - can only be used in case of version 2 of KV

Return type

dict

Returns

key info. This is a Dict with "data" mapping keeping secret and "metadata" mapping keeping metadata of the secret.

create_or_update_secret(self, secret_path: str, secret: dict, method: Optional[str] = None, cas: Optional[int] = None)[source]

Creates or updates secret.

Parameters

  • secret_path (str) -- Path to read from

  • secret (dict) -- Secret to create or update for the path specified

  • method (str) -- Optional parameter to explicitly request a POST (create) or PUT (update) request to the selected kv secret engine. If no argument is provided for this parameter, hvac attempts to intelligently determine which method is appropriate. Only valid for KV engine version 1

  • cas (int) -- Set the "cas" value to use a Check-And-Set operation. If not set the write will be allowed. If set to 0 a write will only be allowed if the key doesn't exist. If the index is non-zero the write will only be allowed if the key's current version matches the version specified in the cas parameter. Only valid for KV engine version 2.

Return type

requests.Response

Returns

The response of the create_or_update_secret request.

See https://hvac.readthedocs.io/en/stable/usage/secrets_engines/kv_v1.html and https://hvac.readthedocs.io/en/stable/usage/secrets_engines/kv_v2.html for details.

Was this entry helpful?