If you want pure-play bash, then you're already doing the right thing, curl
, and although you don't mention it, it's a good idea to use jq
when using REST APIs for parsing results, just remember to request json.
If you can install extra tools, then you can install the vault cli itself. Personally, I never install anything except docker, so I'd run that in a container:
$ alias vault="docker run -it --rm --cap-add IPC_LOCK vault"
$ vault --version
Vault v1.5.3 (9fcd81405feb320390b9d71e15a691c3bc1daeef)
As I'm sure you know, the vault cli, just like curl
, can return json from most of its commands, which you can pipe to jq
(again) for parsing (which is a lot easier than using go-templates IMO).
However, having said that, I have a suspicion that maybe you're asking the wrong question. Getting a secret on your laptop isn't really what vault is for and maybe you're just writing the code on your laptop ready to deploy to a server somewhere in order to provide a secret to that server. If that's the case then doing this in bash may be the wrong approach due to the issue of initial trust.
If you need to get a secret from vault then you have to authenticate first and get a token that has the correct authority (policies) to access the secret you're interested in. Authentication requires some sort of credentials (jwt/username-password/etc.). How do you get those creds to your bash script? You can't commit them to git.
Perhaps you're provisioning an ec2 instance with user-data that contains the creds the script needs (or any other cloud or on-prem equiv. of this process). If that's the case, then you can work out how to provision the machine with the secret it needs instead of the creds to get the secret. This is of course much easier with containers and kubernetes, but you can do the same thing with VMs of various types. In AWS you can do it with Lambda. In Azure with Azure Functions. On-prem you can do it using VMWare. With this approach, you'd be pushing the secrets management function into the platform (shift-left if you like that vocab.), rather than making it a responsibility of your application layer.
Maybe this is going too far and you're just playing around and learning about vault, but you did ask for help with direction. But if it's more than that, you should look at things like SPIFFE and check out the patterns hashicorp has implemented with its K8S sidecar.
jq
to parse it, somthing along the lineVALUE=$(curl [..auth headers..] http://<vault url>/KV/secret | jq '.<can't tell you didn't give any insight>)