gsecrets

gsecrets is a CLI utility and Python library for storing sensitive information using Google Cloud Key Management Service and Cloud Storage.

Architecture

Secrets are stored using "application level encryption". That is, secrets are stored in Google Cloud Storage, encrypted by a key before they are uploaded. Encryption keys are generated and retrieved from Google Key Management Service (KMS).

Deployment and Configuration

Create a keyring, key, and bucket.

Add a file keyring.json into the bucket with the keyring details:

{
	"location": "us-central1",
	"keyring": "my-key-ring",
	"key": "my-crypto-key"
}

Library

import gsecrets
VAULT_LOCATION = "my-project/my-bucket"
secrets_client = gsecrets.Client(VAULT_LOCATION)
    
# Get a single secret
secrets_client.get("slack/token")

# Get a dictionary of gsecrets 
secrets_client.get("manifests/admiral/env.json")

# Get a single secret from a dictionary of secrets 
secrets_client.get("manifests/admiral/env.json.airflow_fernet_key")


# Create or update a secret
secrets_client.put("slack/token", "AAABBBCCC")

# Create or update a secret, uses `dictionary.update` for the update
secrets_client.put("manifests/admiral/env.json", {airflow_fernet_key: "AAABBBCCC"})

# Replace an entire dictionary of secrets
secrets_client.put("manifests/admiral/env.json", {airflow_fernet_key: "AAABBBCCC"}, replace=True)

CLI

A CLI is provided that executes gsecrets inside a Docker wrapper.

Installation:

git clone git@github.com:recurve-inc/gsecrets.git
cd gsecrets
./install.sh

The install procedure adds the cli.sh scripts to /usr/local/bin. Make sure this directory is in your $PATH (normally it is by default).

The CLI depends on coreutils, so make sure if you're on mac you do brew install coreutils.

The library commands map to CLI actions:

gsecrets get my-project/my-bucket/slack/token

gsecrets put my-project/my-bucket/slack/token AAABBBCCC

gsecrets put my-project/my-bucket/slack/env.json.FERNET_KEY AAABBBCCC

# etc.

# For a full list:
gsecrets --help

Install dependencies:

docker-compose run --rm --entrypoint "bash -c" gsecrets bash

pip install e .

Development

Run the CLI inside a container

./cli.sh --help

Release

pip install twine

python setup.py upload