Vault Credential Setup

Boundary
#1

Trying to setup credential brokering for boundary using vault cloud, but keep getting the following error when trying to create the stores.

Error from controller when performing create on vault-type credential store

Error information:
  Kind:                Internal
  Message:             credentialstores.(Service).createInRepo: unable to create credential store: vault.(Repository).CreateCredentialStore: unable to get vault capabilities:
  unknown: error #0: Error making API request.```

anyone hit this before?
#2

It looks like the Vault token you provided doesn’t have the necessary permissions. Did you give the token the permissions in the sample Vault Boundary Controller Policy in the docs?

#3

Hi @mgaffney

Token is generated using the controller policy from the docs, but i think your right that its a permission issue with the token. Might be an additional permission missing that is required when using vault enterprise. Currently digging into the logs to see whats going on.

#4

Hi @ghardak

The VAULT_TOKEN environment variable could be causing a problem if it is set. Not sure if that is helpful but I thought I should mention it. Also, are you using Vault namespaces?

#5

Hey @ghardak

Louis here from the Boundary team, firstly thank you for trying Boundary! Apart from the namespace question from @mgaffney I have two quick follow up questions re your issue:

  1. Is that the full error message you are seeing? Looking at the code, the message should be including some more detail at the end - there might be a bug that is truncating that.
  2. The specific error you are getting happens when Boundary is trying to verify the Vault capabilities, would it be possible for you to verify being able to reach this endpoint manually, and post the response here? /sys/capabilities-self - HTTP API | Vault by HashiCorp
#6

Hi @louisruch,

We are using a Vault Namespaces for each environment, full error message from the controller is below, will run the http api request and see what the output response is.

Error from controller when performing create on vault-type credential store

Error information:
  Kind:                Internal
  Message:             credentialstores.(Service).createInRepo: unable to create credential store: vault.(Repository).CreateCredentialStore: unable to get vault capabilities:
  unknown: error #0: Error making API request.

  URL: POST https://****/v1/sys/capabilities-self
  Code: 403. Errors:

  * 1 error occurred:
  * permission denied


  Status:              500
  context:             Error from controller when performing create on vault-type credential store```
#7

Hey @ghardak

The 403 seems to indicate @mgaffney was on the correct track. It would be interesting to see the results from manually attempting this.

#8

Having similar issue. Trying to connect boundary to HCP vault.
Specified admin namespace as a flag but I get permission denied.
Manually I get a response that is not permission denied.

#9

Which build are you on @Lev1? This was an issue that got fixed in the 0.7 release.

Cheers,
Grant

#10

Facing this issue when trying to connect to boundary through vault

Error from controller when performing authorize-session on a session against target

Error information:
Kind: Internal
Message: targets.(Service).AuthorizeSession: vault.(Repository).Issue: vault.(client).get: vault:external system issue: error #3014: Error
making API request.

URL: GET
Code: 403. Errors:

  • 1 error occurred:
  • permission denied

Status: 500
context: Error from controller when performing authorize-session on a session against target

#11

This looks like a permission error – does the Vault token you created for Boundary have policies associated with it that allow Boundary to read the secrets it needs to?

Boundary and Vault K/V wrong output
#12

path “auth/token/lookup-self” {
capabilities = [“read”]
}

path “auth/token/renew-self” {
capabilities = [“update”]
}

path “auth/token/revoke-self” {
capabilities = [“update”]
}

path “sys/leases/renew” {
capabilities = [“update”]
}

path “sys/leases/revoke” {
capabilities = [“update”]
}

path “sys/capabilities-self” {
capabilities = [“update”]
}

These are the boundary policies

#14

Got it resolved. Thanks @omkensey :+1:

1 Like
#15

Hey @omkensey @louisruch
Trying to integrate vault with boundary credential store for AWS ec2 instance

./boundary connect ssh -target-id ttcp_1234567890 -addr=http://XXXXXXXXXXX -username hello
Credentials:
Credential Source ID: clvlt_jnEOdYQyew
Credential Source Name: new ec2
Credential Store ID: csvlt_4lWBv8Wke7
Credential Store Type: vault
Secret:
username:hello
password:hello123
hello@hst_1234567890’s password:

My goal is to use the credentials stored in Vault in order to hide them from the user and connect automatically to the instance,but still I have to pass it manually, the documentation has the analyst role able to connect postgres db without providing the credential.

#16

Hi @akhila98

Currently all credentials are passed directly back to users to be copy and paste into sessions. This workflow is something we are investigating to improve in future Boundary offerings.
The auto connect you are describing within the postgres command is actually a client side helper that uses the returned creds and passes them through. The end user will still be able to see these credentials by calling the API directly or running boundary authorize-session -id ttcp_1234567890
This functionality is not currently available for the ssh subcommand as most default ssh clients do not allow the password to be provided as a flag. We could look at potentially using something like sshpass, but the users will still be able to see these credentials if they wanted.