cyberark-conjur-cli
cyberark-conjur-cli copied to clipboard
Add ability to persist/use CLI configurations
Current plan but open RFC
FS structure:
$ tree $HOME
├── 700: drwx------ .conjur/
│ ├── 755: drwxr-xr-x default.yml -> <profile_nameXX>.yml
│ ├── 600: drw------- <profile_name1>.yml
│ ├── 755: drwxr-xr-x <profile_name1>.pem -> <hostname1>.pem
│ ├── 600: drw------- <profile_name2>.yml
│ ├── 755: drwxr-xr-x <profile_name2>.pem -> <hostname2>.pem
│ ├── 644: drw-r--r-- <hostname1>.pem
│ ├── 644: drw-r--r-- <hostname2>.pem
...
<profile_name>.yml
:
<profile_name>:
account: <account>
appliance_url: <url>
login_id: <login_id>
# Optional fields. Credentials will be plaintext for now but maybe encrypted later.
api_key: <api_key>
ca_bundle: <path> # default: ./<profile_name>.pem
debug: <bool> # default: false
password: <password>
insecure: <bool> # default: false
tofu: <bool> # default: true
Usage:
# Create config - omitted profile name == "default" (TBD)
$ cli profile create <url> <account> <login_id> \
[--tofu <bool>]|[--insecure <bool>]|[--ca-bundle <pem_path>] \
[--password <password]|[--api-key <api_key>]
# Delete config
$ cli profile delete <profile_name>
# Profile switch for all further CLI commands
$ cli profile <profile_name>
# Show current profile name
$ cli profile
# Use $(cli profile) config
$ cli …
# Use "<profile_name>" config without switching
$ cli -C <profile_name> …
CC: @izgeri / @ismarc / @apotterri / @infamousjoeg / @jodyhuntatx / @ryanprior / @garymoon / @jonahx