`vault_gpg`¶

Interface with the Vault GPG secret engine.

Added in version 1.8.0.

Important

This module requires the general Vault setup.

saltext.vault.states.vault_gpg.key_present(name, real_name=None, email=None, comment=None, key_bits=None, exportable=False, regenerate=False, mount='gpg')[source]¶

Ensure a named GPG key is present.

name: Name of the key.
real_name: Real name of the identity associated with the GPG key.
email: Email of the identity associated with the GPG key.
comment: Comment of the identity associated with the GPG key.
key_bits: Bitlength of the generated GPG key.
exportable: If the raw private key should be exportable. Defaults to false.
regenerate: Whether to regenerate the key when the state parameters do not match an existing key with name. Defaults to false.

Important

When set to true, deletes existing keys to follow the state of all parameters above. Ensure you have a good reason to enable this.

Important

This functionality requires the GPG modules from Salt >=3008.
mount: Mount path the GPG backend is mounted to. Defaults to gpg.

saltext.vault.states.vault_gpg.key_absent(name, mount='gpg')[source]¶

Ensure a named GPG key is absent.

name: Name of the key.
mount: Mount path the GPG backend is mounted to. Defaults to gpg.

saltext.vault.states.vault_gpg.keychain_present(name, mount='gpg', **kwargs)[source]¶

Ensure the named GPG key has been imported in the specified GPG keychain. This is just a convenience wrapper around gpg.present, most keyword arguments are passed through. See there for parameter documentation.

Important

This functionality requires the GPG modules from Salt >=3008.

Hint

You can achieve similar behavior by using Jinja, but risk crashing the whole state compilation when the Vault connection has issues.

{%- set signing_key = salt["vault_gpg.read_key"]("my_key", mount="my_gpg_mount") %}

Ensure my signing key can be used by file.managed source_sig:
  gpg.present:
    - name: {{ signing_key["fingerprint"][-16:].upper() }}
    - text: {{ signing_key["public_key"] | json }}

name: Name of the key (on the Vault mount).
mount: Mount path the GPG backend is mounted to. Defaults to gpg.
kwargs: Most other parameters (exception: text, source, and keys) are passed through to gpg.present.

vault_gpg¶

`vault_gpg`¶