Skip to main content
emisar

HashiCorp Vault operations

v0.1.14

Vault status, seal state, auth/audit/secret backends, mount listing, token & lease introspection, plus operator surface for incident response: revoke lease, revoke leases by prefix, operator step-down, emergency seal. Auth via VAULT_ADDR + VAULT_TOKEN on the runner host. Does NOT include unseal — that requires quorum and shouldn't be automated through a runner.

10 allowed by default 2 need approval by default 2 denied by default
Pack ID
vault
Vendor
emisar
OS
linux
Actions
14
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
vault

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install vault --hash sha256:eb29b485df0379842c4443f9b79d339af297f160e72d7fc5944b50f59f1151bc

Setup

The vault CLI reads the server address and auth token from VAULT_ADDR and VAULT_TOKEN on the runner host.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • VAULT_ADDR required

    Vault API address, including scheme.

  • VAULT_TOKEN

    Token to authenticate with. Required unless a ~/.vault-token file is present on the runner host.

Notes

  • Alternative to VAULT_TOKEN : a ~/.vault-token file (written by vault login ) on the runner host — read from disk, so it needs no inherit_env entry.
  • The token's policies gate every action; the incident-response mutators (revoke_lease, lease_revoke_prefix, operator_step_down, operator_seal) need sys/* capabilities, so a read-only token will see those denied.
  • TLS to an https:// VAULT_ADDR uses the system CA bundle; set VAULT_CACERT for a private CA, or VAULT_SKIP_VERIFY=1 only in non-production.

Verify it works

Runs vault.status, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify vault

Install and configure a pack walks through the whole sequence on a host.

Actions 14 total

View on GitHub
  • vault.cubbyhole_list exec low Low — read-only or trivially reversible

    vault list cubbyhole

    List the runner token's own cubbyhole (each token sees only its own).

    View source on GitHub
  • vault.lease_revoke_prefix exec high High — service-affecting

    vault lease revoke -prefix <prefix>

    Revoke every lease under a path prefix. Use after a compromise to invalidate every dynamic credential for one engine. Irreversible for issued credentials — affected services must re-authenticate.

    View source on GitHub
  • vault.leases_count exec low Low — read-only or trivially reversible

    vault list sys/leases/lookup/<prefix>

    Count of active leases under one mount prefix.

    View source on GitHub
  • vault.list_audit exec low Low — read-only or trivially reversible

    vault audit list

    List enabled audit devices.

    View source on GitHub
  • vault.list_auth exec low Low — read-only or trivially reversible

    vault auth list

    List all auth method mounts.

    View source on GitHub
  • vault.list_mounts exec low Low — read-only or trivially reversible

    vault secrets list

    List all secret engine mount points.

    View source on GitHub
  • vault.list_policies exec low Low — read-only or trivially reversible

    vault policy list

    List all policy names.

    View source on GitHub
  • vault.operator_seal exec critical Critical — data loss or irreversible

    vault operator seal

    Seal Vault. ALL clients lose access to secrets immediately; ongoing requests fail. Recovery requires unseal keys from a quorum of shareholders. Use only for compromised-cluster containment.

    View source on GitHub
  • vault.operator_step_down exec critical Critical — data loss or irreversible

    vault operator step-down

    Force the active node to step down. A standby will take over within seconds. Use this to force a failover or to drain a node before maintenance.

    View source on GitHub
  • vault.read_policy exec low Low — read-only or trivially reversible

    vault policy read <name>

    Read the HCL document for one policy.

    View source on GitHub
  • vault.revoke_lease exec high High — service-affecting

    vault lease revoke <id>

    Revoke one lease — the credential becomes invalid immediately. Anyone using it gets a 403 from the downstream system.

    View source on GitHub
  • vault.seal_status exec low Low — read-only or trivially reversible

    vault status (seal fields)

    Show sealed/unsealed state + threshold + progress.

    View source on GitHub
  • vault.status exec low Low — read-only or trivially reversible

    vault status

    Show top-level Vault status: sealed, version, HA mode, active node.

    View source on GitHub
  • vault.token_lookup_self exec low Low — read-only or trivially reversible

    vault token lookup

    Show metadata on the current token (the runner's) — accessor, policies, ttl. Useful to debug policy denials. The token itself (data.id) is redacted from the output.

    View source on GitHub
← Back to registry
Pack reference  Publish your own