operator import

The operator import command imports secrets from external systems in to Vault. Secrets with the same name at the same storage path will be overwritten upon import.

Imports can be long-running processes

You can write import plans that read from as many sources as you want. The amount of data migrated for each source depends on the filters applied and the dataset available. Be mindful of the time needed to read from each source, apply any filters, and store the data in Vault.

Examples

Read the config file import.hcl to generate a new import plan:

$ vault operator import -config import.hcl plan

Output:

-----------
Import plan
-----------
The following namespaces are missing:
* ns-1/

The following mounts are missing:
* ns-1/mount-1

Secrets to be imported from the source "my-dest-1":
* secret-1
* secret-2

Configuration

The operator import command uses a dedicated configuration file to specify the source, destination, and mapping rules.

source_gcp {
  name = "my-gcp-source-1"
  credentials = "@/path/to/service-account-key.json"
}

destination_vault {
  name = "my-dest-1"
  address = "http://127.0.0.1:8200/"
  token = "root"
  namespace = "ns-1"
  mount = "mount-1"
}

mapping_passthrough {
  name = "my-map-1"
  source = "my-gcp-1"
  destination = "my-dest-1"
  priority = 1
}

Usage

The operator import command accepts the following flags:

-config (string: "<import.hcl>") - Path to the import configuration HCL file. The default path is import.hcl.
auto-approve (bool: <false>) - Automatically response "yes" to all user-input prompts for the apply command.
auto-create (bool: <false>) - Automatically creates any missing namespaces and mounts when "running the "apply" command.
-log-level (string: "info") - Log verbosity level. Supported values (in order of descending detail) are trace, debug, info, warn, and error. You can also set log-level with the VAULT_LOG_LEVEL environment variable.