Skip to main content
emisar

HashiCorp Vault operations

v0.1.8

Vault status, seal state, auth/audit/secret backends, mount listing, token & lease introspection, plus operator surface for incident response: revoke lease, revoke leases by prefix, operator step-down, emergency seal. Auth via VAULT_ADDR + VAULT_TOKEN on the runner host. Does NOT include unseal — that requires quorum and shouldn't be automated through a runner.

10 allowed by default 2 need approval by default 2 denied by default
Pack ID
vault
Vendor
emisar
OS
linux
Actions
14
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
vault

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install vault --hash sha256:81805eb9153e64a5cd8a447460a71ffc83d27e521e2039b511e34842b902bc5e

Actions 14 total

View on GitHub
  • vault.cubbyhole_list exec low

    vault list cubbyhole

    Lists the runner token's own cubbyhole (each token sees only its own).

    View source on GitHub
  • vault.lease_revoke_prefix exec high

    vault lease revoke -prefix <prefix>

    Revoke every lease under a path prefix. Use after a compromise to invalidate every dynamic credential for one engine. Irreversible for issued credentials — affected services must re-authenticate.

    View source on GitHub
  • vault.leases_count exec low

    vault list sys/leases/lookup/<prefix>

    Count of active leases under one mount prefix.

    View source on GitHub
  • vault.list_audit exec low

    vault audit list

    List enabled audit devices.

    View source on GitHub
  • vault.list_auth exec low

    vault auth list

    List all auth method mounts.

    View source on GitHub
  • vault.list_mounts exec low

    vault secrets list

    List all secret engine mount points.

    View source on GitHub
  • vault.list_policies exec low

    vault policy list

    List all policy names.

    View source on GitHub
  • vault.operator_seal exec critical

    vault operator seal

    Seal Vault. ALL clients lose access to secrets immediately; ongoing requests fail. Recovery requires unseal keys from a quorum of shareholders. Use only for compromised-cluster containment.

    View source on GitHub
  • vault.operator_step_down exec critical

    vault operator step-down

    Forces the active node to step down. A standby will take over within seconds. Use this to force a failover or to drain a node before maintenance.

    View source on GitHub
  • vault.read_policy exec low

    vault policy read <name>

    Read the HCL document for one policy.

    View source on GitHub
  • vault.revoke_lease exec high

    vault lease revoke <id>

    Revokes one lease — the credential becomes invalid immediately. Anyone using it gets a 403 from the downstream system.

    View source on GitHub
  • vault.seal_status exec low

    vault status (seal fields)

    Show sealed/unsealed state + threshold + progress.

    View source on GitHub
  • vault.status exec low

    vault status

    Show top-level Vault status: sealed, version, HA mode, active node.

    View source on GitHub
  • vault.token_lookup_self exec low

    vault token lookup

    Show metadata on the current token (the runner's) — accessor, policies, ttl. Useful to debug policy denials. The token itself (data.id) is redacted from the output.

    View source on GitHub
← Back to registry
Pack reference Publish your own →