keb
10d1fc63c7
Regroups the config, while there are no users to migrate: - `ui`: icons, sourcesView, collapseGroups, loadDelay, expiryWarningDays - `values`: revealTimeout, hideOnBlur, clipboardClear - `storage`: cache, history - `updates`: autoCheck (was updateCheck), autoCheckInterval (new, 24h by default), updateSources (was releases) - `providers.timeout` (was timeout), plus `timeout` on azure, databricks and repos overriding it for that provider; `--timeout` still sets them all - `sharing` (was share), in the config and in a repo's `.lazysecrets.yaml` docs/config.md and the pages naming these keys are updated. Reviewed-on: #60 Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
3.2 KiB
Azure Key Vault
lazysecrets reads Azure with your az CLI login: run az login once, and
it reuses it.
Accounts
Every account signed in to az gets its own group in the Sources pane
(az login again with another account to add one), and each account's
vaults are read with that account. A subscription several accounts can see
is listed under each, since their permissions can differ.
A service principal is used instead when AZURE_CLIENT_ID,
AZURE_TENANT_ID and a secret or certificate are set in the environment.
On an account's group row, the fourth pane shows who it signs in as: name,
user, tenant, object ID, whether the session used MFA, directory roles
(built-in ones by name) and its subscriptions, read from az's account list
and the token lazysecrets already has: no requests of their own. y on
the row copies the object ID, the one access policies and role
assignments ask for; l goes into the pane, where j/k pick any
field, / filters them (/tenant) and y copies the selected one.
If an account's az login has expired, the status line says so once, and the
Details pane on that account's rows says it until you sign in: press L
there to run az login for it without leaving lazysecrets, and everything
reloads.
Permissions
Vaults are discovered with Resource Graph, so you need read access to the vault resources (e.g. Reader). Key Vault data-plane access is separate (Azure RBAC or access policies). With RBAC, typically:
| To | Role |
|---|---|
| list secrets, keys and certificates | Key Vault Reader |
| read secret values | Key Vault Secrets User |
| read certificate details | Key Vault Certificate User |
A missing permission is shown in the pane, shortened to what was denied (the action, or the access policy permission), with what to check: a role or group to activate in PIM, access from the vault's owner, or, when its firewall refused, the network you're on.
Vaults you can't discover
A vault you can read but not see through Resource Graph can be pinned in the config; it's listed under "Pinned vaults" and read with az's default account:
providers:
azure:
vaults:
- https://kv-foo.vault.azure.net/
hideSubscriptions: [platform-mgmt] # by name or ID
What's shown
Secrets, keys and certificates, each on their own tab of the Secrets pane
([/]). space reveals a secret's value, or the public material of a
key (PEM public key) or certificate; private key material is never
fetched. v lists an item's versions. Items expiring within
ui.expiryWarningDays (30 by default) are marked ⚠ 12d, expired ones ✗.
The status pane (0) lists them across every vault loaded, opened or
cached, soonest first, and its line counts them (⚠ 3 expiring); enter
on one goes to it. That makes no requests of its own: expiry dates come
with the lists. It says how many vaults it covers; ctrl+a in search
loads the rest.
On a vault, the right pane shows its settings: resource group, location, SKU, whether access is by Azure roles or access policies, soft delete and purge protection, which networks can reach it, private endpoints and tags. They come with the list of vaults, so they cost no extra requests and are cached with it.