I am looking for help on a direction on where to go from here. I have a Hasicorp Vault server running and accessible over DNS (local). I need to have a script get a secret from it then use that secret. I am not sure where to go from there. I know I want to use a bash script for this but past that I don't know what to do.

Until now I have been using curl to test it.


  • Have you seen digitalocean.com/community/tutorials/… ?? This seems like the sort of thing that most Vault tutorials would mention. – chicks Jul 12 '18 at 17:38
  • @chicks Yes I have seen that and followed it to set it up. None of that is useful to what I asked. I asked about using bash to interact with vault (likely via curl) and extract a secret (a value in a K:V) and use that in the bash script (likely as a variable). So no that guide is of no use in this case. – user8517 Jul 12 '18 at 18:44
  • 1
    wiki.bash-hackers.org/syntax/expansion/cmdsubst might help you understand command substitution in a more general way. – chicks Jul 12 '18 at 19:01
  • Vault return a json, curl to get the json, jq to parse it, somthing along the line VALUE=$(curl [..auth headers..] http://<vault url>/KV/secret | jq '.<can't tell you didn't give any insight>) – Tensibai Jul 13 '18 at 14:38
  • @Tensibai Yes that is what I have been doing, hence why I said I used curl to test it, was looking for something better, guess that has gone over everyone's head. – user8517 Jul 13 '18 at 17:18

The vault docs mention a -field parameter for the read subcommand. So you should be able to put this into a shell script:

SECRET=$(vault read secret/mysecret -field foo)

Other vault docs use the vault kv get in the same way so you might try:

SECRET=$(vault kv get secret/mysecret -field foo)
  • Again it seems like you are thinking I am trying to do this locally on my vault server. I am not doing that. Think of it this way, I have a vault server. I have a laptop. Both are different machines not connected except by the internet. I need to use a curl command to query the vault server. I then need to take the result of that query which is a JSON object and I need to extract the value at data.value. That make more sense? I repeat though, this is being done on a different machine than the vault server! – user8517 Jul 12 '18 at 19:09
  • 3
    @JoshKirby you can install the vault command line on any machine... – Tensibai Jul 13 '18 at 14:39

Vault has a REST API available for reading.


In your script, just curl the API.

  • 1
    I am aware of that API. I was looking for something better than curl and maybe something more secure. I have given up on that idea and am using curl instead. So much for nice and simple/secure. – user8517 Jul 13 '18 at 13:04
  • 1
    You have to install an SSL on Vault for that kind of thing to be secure – Mike Jul 13 '18 at 13:37
  • I have TLS installed, still was hoping for a more secure way of doing it. – user8517 Jul 13 '18 at 17:17

This mighty be a lengthy procedure but worth implementing, creating child tokens to fetch information from Vault Server.

Execute following procedure at Vault Server.

  1. Create policy to restrict the access for clients.
cat auth-policy.hcl 
path "secret/*" {
  capabilities = ["read"]
  1. Write the policy
vault policy write client-access auth-policy.hcl                         
Success! Uploaded policy: client-access 
  1. Create token
vault token create -policy=client-access -period=768h                                    

Key                Value                                                        
---                -----                                                        
token              *********************                         
token_accessor     *********************                         
token_duration     768h                                                         
token_renewable    true                                                         
token_policies     [client-access default]  
vault policy write client-access auth-policy.hcl                         
Success! Uploaded policy: client-access 

Configure -period in hours. Token should be renewed after configured period of time. Configure expiry period accordingly by considering max_lease_ttl and default_lease_ttl in config.hcl.

Configure these parameters in config.hcl during Vault startup.

max_lease_ttl = "1000h"
default_lease_ttl = "1000h"

Now using this child token, from your laptop/machine, you will be able to fetch the information from Vault server, using APIs.

$ curl -H "X-Vault-Token: CHILD-TOKEN" -X GET VAULT-URL/v1/secret/SECRET | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   241  100   241    0     0    396      0 --:--:-- --:--:-- --:--:--   396
  "request_id": "e53887a2-fe5a-2f27-2121-c716a697f0e8",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 25920000,
  "data": {
  "wrap_info": null,
  "warnings": null,
  "auth": null

With this child token, users can only read the data but neither write or delete data as configured in auth-policy.

If you still want to secure child token you can save it in Jenkins credentials and will be fetched into bash script when build triggered.

Hope this helps! Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy