cloudflare

Vault Secrets Plugin - Cloudflare

Vault secrets plugins to simplying creation, management, and revocation of Cloudflare API tokens.

Usage

Setup Endpoint

1. Download and enable plugin locally (TODO)

2. Configure the plugin

   vault write /cloudflare/config/token token=<token>
   

3. Add one or more policies

Configure Policies

# NOTE: this policy will not work and is just an example
vault write /cloudflare/roles/<role-name> policy_document=-<<EOF
[
  {
    "id": "f267e341f3dd4697bd3b9f71dd96247f",
    "effect": "allow",
    "resources": {
      "*": "*"
    },
    "permission_groups": [
      {
        "id": "c8fed203ed3043cba015a93ad1616f1f",
        "name": "Zone Read"
      },
      {
        "id": "82e64a83756745bbbb1c9c2701bf816b",
        "name": "DNS Read"
      }
    ]
  }
]
EOF

you can then read from the role using

vault read /cloudflare/creds/<role-name>

Rotating the Root Token

The plugin supports rotating the configured admin token to seamlessly improve security.

To rotate the token, perform a 'write' operation on the config/rotate-root endpoint

> export VAULT_ADDR="http://localhost:8200"
> vault write -f config/rotate-root
Key      Value
---      -----
name     vault-admin-{timestamp in nano seconds}

Generate a new Token

To generate a new token:

Create a new cloudflare policy and perform a 'read' operation on the creds/<role-name> endpoint.

# To read data using the api
$ vault read cloudflare/role/dns-edit
Key                Value
---                -----
lease_id           cloudflare/creds/test/956Fo9MQgleoqosK5wuMVwPC
lease_duration     768h
lease_renewable    true
id                 9c40db059267e91c7f3f22220c1536ed
token              <token>

Development

Build and test with Go:

# build a local version of the plugin
$ mkdir -p bin
$ CGO_ENABLED=0 go build -o bin/vault-plugin-secrets-cloudflare ./cmd/cloudflare

# run unit tests
$ go test ./...

# start OpenBao/Vault dev server and mount plugin
$ bash ./scripts/dev.sh