DevOps Secret Manager
  • 6 minutes to read
  • Dark
    Light
  • PDF

DevOps Secret Manager

  • Dark
    Light
  • PDF

Article summary

The senhasegura DevOps Secret Management (DSM) offers a rapid and secure way for tools and applications to request confidential information such as secrets, credentials and other sensitive data that are used on DevOps lifecycle.

The purpose of this section is to provide guidance for DevOps teams that need integration with senhasegura to manage all secrets used on their pipeline.

In this section, the following DevOps functions will be covered:

  • Request a secret to be used on an application
  • Provision a new credential to be used on an applications
  • Deprovision a credential

For information about DSM's API for automations, access the Automations document.

Method

The senhasegura web integration service has a method for query secrets stored in the application.

Query secret

GET https://vault_url/iso/dapp/application 

The application method queries all secrets linked to an application authorization.

Response

FieldTypeDescription
nameStringApplication name
descriptionStringApplication description
tagsStringTags that identify the application
systemStringSecret system
environmentStringSecret environment
secret_idIntegerSecret ID
secret_nameStringSecret Name
identityStringSecret identifier
versionStringSecret version
expiration_dateDate/TimeSecret expiration date
engineStringSecret engine
dataStringSecret values
{
    "response": {
        "status": 200,
        "mensagem": "Application 5",
        "erro": false,
        "message": "Application 5",
        "error": false
    },
    "application": {
        "name": "postman",
        "description": null,
        "tags": [
            ""
        ],
        "system": "back",
        "environment": "test",
        "secrets": [
            {
                "secret_id": "106",
                "secret_name": "application5",
                "identity": "application5",
                "version": "",
                "expiration_date": "",
                "engine": "Kubernetes",
                "data": [
                    {
                        "hostname": "application5_v_test",
                        "username": "ADMIN_V_USR",
                        "password": "ADMIN_V_PW",
                        "additional_information": "ADMIN_V_SCHEMA",
                        "ip": "app.application.com"
                    },
                    {
                        "access_key_id": "LKU5YC6QWAT487S4KEK",
                        "secret_access_key": "sack10821du07f9sacfsdaasdf",
                        "TTL": null
                    },
                    {
                        "my_key_name": "my_key_value",
                        "my_key_name_2": "my_key_value_2"
                    }
                ]
            }
        ]
    }
}

Response with SSH as secret

{
    "response": {
        "status": 201,
        "mensagem": "Secret created successfully.",
        "erro": false,
        "cod_erro": 0,
        "message": "Secret created successfully.",
        "error": false,
        "error_code": 0
    },
    "application": {
        "name": "postman",
        "description": "teste",
        "tags": [
            "abc",
            "def",
            "teste"
        ],
        "system": "inetconfig",
        "environment": "stage",
        "secrets": [
            {
                "secret_id": "3",
                "secret_name": "state_secret",
                "identity": "cart/americanas/npf/cassandra",
                "version": "205",
                "description": "Chamada de API",
                "expiration_date": "2022-08-18 11:10:00",
                "engine": "GitLab",
                "data": [
                    {
                        "HOSTNAME": "AWS Gateway",
                        "USERNAME": "user",
                        "CONNECTION_STRING": "mongodb://api-server/auth",
                        "private_key": "An error occurred while encrypting the text",
                        "public_key": "ssh-rsa dsafffasdfads+FoCrHU0ZZSeIK4rkoB+O55qz0Ns527ROxwslDwn0TsLMwGTr3L4QCmnihmBOF7PlX7027DtldO0gFswdwPDKynAK2Crn6bcBQg8PAw6tUAM7/QWFosW13JzrbDz6gUV+DXMilQPUIJ7CsdfmubE/jFzJ/aBN2f+5mK6Xf3ghvGLo4+PriAUZO/x1XEm4+destdfsadfasafsd+GwwgFYVvTMOUYjjHYcqKjjqah8F8ltN5aN+9P3cwWlbnO/RoORHgpavBcOMDBXOHHtWwT4qSWNZJ4/BIeBr3ACTjqoUrDdAsgr2u+i46l user\n",
                        "PASSWORD": "sbgiXZU+5qmejm/kYqb+asdffsdaafsd/PPjcBxvr9S0jS1+F7Qc2HZ0N0PqQFw4I0p2X943+Y4wYR8RXSgFqtxuEbYBMv7TJijqIA0fVWkVNdCaqRVIpIbdtGjpUuf+asdffdsa/maPt0T9KfkKJSPh9WY2O8oRkCpRays8Lihp3ZP+asdffsd==",
                        "ip": "aws.amazon.com"
                    }
                ]
            }
        ]
    }
}

Create or update a secret

POST https://vault_url/iso/sctm/secret

Parameters

FieldTypeDescription
NameStringSecret Name
IdentityStringSecret's Identity
Expiration_DateDate/timeSecret's deactivation date
DescriptionStringSecret Description
EngineStringSecret's Engine must be a valid engine registered in senhasegura
renew_cloud_timeIntSets the time to renew cloud access keys in minutes. If omitted is ignored, but with empty array, will disable auto-renew
renew_credential_timeIntSet the time to renew credentials in minutes. If omitted is ignored, but with empty array, will disable auto-renew
renew_ephemeral_credential_timeIntSets the time to renew ephemeral credentials in minutes. If omitted is ignored, but with empty array, will disable auto-renewal
dateStringMust be valid base64 encoded json as in Data Example

Data Example

{
    access_keys:
    [
        {
            access_key:
            {
                type: "aws",
                fields:
                {
                    access_key_id: "AKIAREVEFYNPPAOT3PF6",
                    access_key_id_label: "AWS_ACCESS_KEY_ID",
                    secret_access_key: "AStrongPass",
                    secret_access_key_label: "AWS_SECRET_ACCESS_KEY",
                }
            }
        },
    ],
    credentials:
    [
        {
            credential:
            {
                fields:
                {
                    user: "cred_a",
                    user_label: "USERNAME",
                    host: "aws.amazon.com",
                    host_label: "HOSTNAME",
                    password: "StrongPass",
                    password_label: "PASSWORD",
                    additional_information: "mongodb://api-server/auth",
                    additional_information_label: "CONNECTION_STRING",
                }
            }
        },
        {
            credential:
            {
                fields:
                {
                    user: "an_username",
                    user_label: "USERNAME",
                    host: "an_ip",
                    host_label: "HOSTNAME",
                    password: "StrongPass",
                    password_label: "PASSWORD",
                    additional_information: "the_additional_info",
                }
            }
        },
    ]
}

Response

FieldTypeDescription
nameStringApplication Name
descriptionStringApplication Description
tagsStringApplication tag
systemStringSecret System
environmentStringSecret Environment
secret_idIntegerSecret ID
secret_nameStringSecret Name
identityStringSecret Identifier
versionStringSecret version
expiration_dateDate/TimeSecret Expiration Date
engineStringSecret Engine
dataStringSecret Values
{
    "response": {
        "status": 201,
        "mensagem": "Secret created successfully.",
        "erro": false,
        "cod_erro": 0,
        "message": "Secret created successfully.",
        "error": false,
        "error_code": 0
    },
    "application": {
        "name": "postman",
        "description": "teste",
        "tags": [
            "abc",
            "def",
            "teste"
        ],
        "system": "inetconfig",
        "environment": "stage",
        "secrets": [
            {
                "secret_id": "7",
                "secret_name": "state_secret",
                "identity": "example_2",
                "version": "2",
                "description": "Chamada de API",
                "expiration_date": "2022-08-18 11:10:00",
                "engine": "GitLab",
                "data": [
                    {
                        "AWS_ACCESS_KEY_ID": "AKIAREVEFYNPPAOT3PF6",
                        "AWS_SECRET_ACCESS_KEY": "fd/ZmmciA4d8CqkXIzK8l2oWrUY7+fds/aasdf+WwP5cTAQW5mpr9XAHiGS1zkRQEUvJ7pta3ABrAeRt3QH6UuuGwPunATFdhFvAG/lTlrby6z+dfdfas/cKUzQpHpQE0UNxNwzCauRpbPDOUzMnpRopbyGQDzdkN0uXSXJLh3kraX+/qQ/v3riN1pB+Wuzd4zvxLfeH6oA==",
                        "TTL": ""
                    },
                    {
                        "APP": "Postman",
                        "CONNECTION_STRING": "mongodb://api-server/auth",
                        "DATE": "date",
                        "HOSTNAME": "an_ip",
                        "PASSWORD": "StrongPass",
                        "USERNAME": "an_username"
                    }
                ]
            }
        ]
    }
}

Create or update an application

POST https://vault_url/iso/dapp/application 

Parameters

FieldTypeDescription
NameStringSecret Name
IdentityStringSecret Identity
Expiration_DateDate/TimeSecret's deactivation date
DescriptionStringSecret Description
EngineStringSecret's Engine must be a valid engine registered in senhasegura
renew_cloud_timeIntSet renewal time to cloud access keys in minutes. If omitted will disable auto-renewal
renew_credential_timeIntSet renewal time to credentials in minutes. If omitted will disable auto-renewal
renew_ephemeral_credential_timeIntSet renewal time to ephemeral credentials in minutes. If omitted will disable auto-renewal
DataStringMust be valid base64 encoded json

Response

FieldTypeDescription
Unique keyStringUnique identifier of an authorization, if the value is sent, the environment and system fields will be ignored for the authorization search
ApplicationStringApplication Name
SystemStringSystem to which the authorization belongs, used for consultation, only used for writing in new authorizations
EnvironmentStringEnvironment to which the authorization belongs, used for consultation, only used for writing in new authorizations
DescriptionStringApplication description
Authentication MethodStringApplication authentication and authorization method, this parameter is only used when creating the application, when updating it is ignored
Line of BusinessStringDefines the application's line of business
Application TypeStringDefines the application type
TagsStringDefine applications tags
Amazon ARNs (for AWS Authentication)StringDefine application ARNs
Cloud Dynamic Provising profileStringDefines application cloud dynamic provisioning profiles
Credential Dynamic Provising Profile (device and profile)ArrayDefines application ephemeral credential dynamic provisioning profiles
Authorized ResourcesStringDefines the authorized resources of the authorization, used only when creating the authorization
Expiration date/timeDate/TimeSecret expiration date, used only when creating the authorization
Enable Encryption of sensitive information?BooleanDefines encryption of sensitive authorization data, used only in authorization creation
Allowed IPsStringDefines the allowed IPs of the authorization, used only when creating the authorization
Allowed HTTPS refersStringDefines the allowed HTTP referrers of the authorization, used only when creating the authorization
Certificate FingerprintStringDefines the fingerprint of the authorization certificate, used only when creating the authorization

Response

FieldTypeDescription
idStringApplication ID
signatureStringApplication Signature
{
    "response": {
        "status": 200,
        "mensagem": "Application updated: (4) postman | Authorization found: (6)",
        "erro": false,
        "cod_erro": 0,
        "message": "Application updated: (4) postman | Authorization found: (6)",
        "error": false,
        "error_code": 0
    },
    "id": "applicationID",
    "signature": "signature"
}

Providing a credential

POST https://vault_url/iso/coe/dapp/provision 

Create a new credential secret to be used on a container.

Parameters

FieldTypeDescriptionRequired
pod_nameStringName of the pod that will use the credentialYes
deployStringName of the deploy that will use the credentialYes
namespaceStringNamespace of the container that will use the credentialYes

Response

FieldTypeDescription
nameStringApplication name
descriptionStringApplication description
tagsStringTags that identify the application
systemStringSistema da secret
environmentStringAmbiente de secret
secret_idIntegerID da secret
secret_nameStringNome da secret
identityStringIdentificador da secret
versionStringVersão da secret
expiration_dateDate/TimeData de expiração da secret
engineStringEngine da secret
dataStringValor da secret
{
    "response": {
        "status": 200,
        "mensagem": "Application 6",
        "erro": false
    },
    "application": {
        "name": "runb",
        "description": null,
        "tags": [
            ""
        ],
        "system": "senhasegura",
        "environment": "lab",
        "secrets": [
            {
                "secret_id": "3",
                "secret_name": "secure-demo",
                "identity": "secure-demo",
                "version": "",
                "expiration_date": "",
                "engine": "Kubernetes",
                "data": {
                    "APP_VAR1": "fX6v8vh7TADY",
                    "APP_VAR2": "vlln0XkBNWIk",
                    "APP_VAR3": "7qWgm1EBFnQb",
                    "APP_DB_PASSWORD": "4i8Vm0khqTWs",
                    "APP_SECRET": "GSePWjXyd91K"
                }
            }
        ]
    }
}

Removing a credential

POST https://vault_url/iso/coe/dapp/deprovision 

Remove a credential secret to be used on a container.

Parameters

FieldTypeDescriptionRequired
pod_nameStringName of the pod that will use the credentialYes
deployStringName of the deploy that will use the credentialYes
namespaceStringNamespace of the container that will use the credentialYes
secret_idIntegerSecret IDYes

Was this article helpful?

What's Next