A tool for generating environment exports from a YAML file. Now with vault integration!

Given a variables.yml file like this:

---
  vars:
    GLOBAL: "global"

  secrets:
    SECRET_TEST: "secret/test"

  environments:
    stage:
      vars:
        ENVIRONMENT: "stage"

      secrets:
        ANOTHER_SECRET: "secret/test2"

      dcs:
        ndc_one:
          secrets:
            YET_ANOTHER_SECRET: "secret/test3"
          vars:
            DC: "one"

        ndc_two:
          secrets:
            YET_ANOTHER_SECRET: "secret/test3"
          vars:
            DC: "one"

Output would look like this:

% buildenv -e stage -d ndc_one
# Setting Variables for:
# Environment: stage
# Datacenter: ndc_one
# Global Vars:
export GLOBAL="global"
# Global Secrets:
export SECRET_TEST="It Works" # secret/test
# Environment (stage) Vars:
export ENVIRONMENT="stage"
# Environment (stage) Secrets:
export ANOTHER_SECRET="It Still Works" # secret/test
# Datacenter (ndc_one) Specific Vars:
YET_ANOTHER_SECRET: "secretpassword"
export DC="one"

A Note About Vault: If you have secrets defined in either the global or environment scope, it's a mapping from environment variable to the path in vault. Buildenv uses all the standard vault environment variables to communicate with vault (VAULT_ADDR and VAULT_TOKEN being the two you're most likely to use.)

It is recommended to use the flag -m when running on linux or docker container with swap enabled. This will attempt to lock memory and prevent secrets from being written to swap space. If running on a docker container it may be necessary to add --cap-add=IPC_LOCK to the docker run command or in the docker-compose file to allow this. More info can be found at https://hub.docker.com/_/vault under Memory Locking and 'setcap'.

To test with vault, run:

docker-compose up vault -d
export VAULT_ADDR="http://localhost:8200"
export VAULT_TOKEN="test"
vault write secret/test "value=It Works"
vault write secret/test2 "value=It Still Works"
buildenv -e stage
docker-compose down