Install HCP Vault Secrets CLI

8min
|
HCP
Vault

Before you can interact with HCP Vault Secrets using the command-line interface (CLI), the vlt CLI must be installed and configured.

Once installed, you can choose to authenticate interactively using your HCP Portal credentials, or non-interactively using a HCP service principal.

Prerequisites

An existing HCP account
Completed the Create a secret in HCP Vault Secrets tutorial
Homebrew installed

Install HCP Vault Secrets CLI

The HCP Vault Secrets CLI is available for download from releases.hashicorp.com/vlt as a zip archive and via popular package managers.

MacOS users can use Homebrew to install the CLI. Refer to the Homebrew installation instructions if it is not already installed.

Open a new terminal.
Install the HashiCorp tap.
```
$ brew tap hashicorp/tap
```
Install the HCP Vault Secrets CLI.
```
$ brew install vlt
```

Verify the installation.

$ vlt
Usage: vlt [--version] [--help] <command> [<args>]

Available commands are:
    apps       Lists the apps in the project
    config     Lists or updates the current config
    login      Login to the Vault Secrets web services
    logout     Log out of the Vault Secrets web services
    run        Run a process while injecting secrets as ENV vars
    secrets    Lists the secrets in an app
    version    Shows the vlt cli version and golang version

HashiCorp does not maintain installation binaries using Chocolatey or Scoop. The latest version of the HCP Vault Secrets CLI is available by manual installation.

This example downloads the Windows AMD64 binary using PowerShell. Use a Windows account with appropriate permissions to extract the binary to the Program Files directory and update the PATH.

Launch a PowerShell terminal using Run as Administrator. If prompted, click Yes.

Download the zip archive to the current working directory.

$ Invoke-WebRequest -URI https://releases.hashicorp.com/vlt/1.0.0/vlt_1.0.00_windows_amd64.zip`
   -OutFile vlt_1.0.0_windows_amd64.zip

Unzip the file.

$ Expand-Archive -Path .\vlt_1.0.0_windows_amd64.zip -Destination `C:\Program Files\HashiCorp\vlt\bin\`

Update the $PATH environment variable.

$ $Env:path = $env:path + ";C:\Program Files\HashiCorp\vlt\bin"

Verify the vlt binary is available.

$ vlt
Usage: vlt [--version] [--help] <command> [<args>]

Available commands are:
    apps       Lists the apps in the project
    config     Lists or updates the current config
    login      Login to the Vault Secrets web services
    logout     Log out of the Vault Secrets web services
    run        Run a process while injecting secrets as ENV vars
    secrets    Lists the secrets in an app
    version    Shows the vlt cli version and golang version

The installation steps provided were tested on Ubuntu 22.04 and should work on other Debian based distributions that utilize the apt package manager.

Update the apt repository.
```
$ sudo apt update
```

Download the HashiCorp GPG key.

$ curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

Add the HashiCorp repo.

$ echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

Install the vlt CLI.

$ sudo apt update && sudo apt install vlt -y

Verify the installation.

$ vlt
Usage: vlt [--version] [--help] <command> [<args>]

Available commands are:
    apps       Lists the apps in the project
    config     Lists or updates the current config
    login      Login to the Vault Secrets web services
    logout     Log out of the Vault Secrets web services
    run        Run a process while injecting secrets as ENV vars
    secrets    Lists the secrets in an app
    version    Shows the vlt cli version and golang version

The installation steps provided were tested on Amazon Linux 2 and should work on other distributions that utilize the yum package manager.

Update the yum repository.
```
$ sudo yum update
```
Install yum-utils.
```
$ sudo yum install -y yum-utils
```

Add the HashiCorp repository.

Note

Refer to the official packaging guide for the correct RHEL/CentOS or Fedora configuration.

$ curl -fsSL https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo | sudo tee /etc/yum.repos.d/hashicorp.repo

Update the local yum repository.
```
$ sudo yum update
```
Install the vlt CLI.
```
$ sudo yum install vlt -y
```

Verify the installation.

$ vlt
Usage: vlt [--version] [--help] <command> [<args>]

Available commands are:
    apps       Lists the apps in the project
    config     Lists or updates the current config
    login      Login to the Vault Secrets web services
    logout     Log out of the Vault Secrets web services
    run        Run a process while injecting secrets as ENV vars
    secrets    Lists the secrets in an app
    version    Shows the vlt cli version and golang version

To install the HCP Vault Secrets CLI, find the appropriate package for your system and download it. The vlt CLI is packaged as a zip archive.

After downloading the zip archive, unzip the package. The HCP Vault Secrets binary runs as a single binary named vlt. Any other files in the package can be safely removed and vlt will still function.

The final step is to make sure that the vlt binary is available on the PATH. See this page for instructions on setting the PATH on Linux and Mac. This page contains instructions for setting the PATH on Windows.

Configure the HCP Vault Secrets CLI

Interactive logins launch a web browser to have you authenticate with your HCP user account through a supported authorization method such as username and password, single sign-on (SSO), or GitHub.

Refer to the HCP Vault Secrets documentation to review HCP roles and permissions.

Log in to HCP Vault Secrets using the interactive login.
```
$ vlt login
```
A new browser will open, log into your HCP account. Once complete, your browser will display Login is successful. You may close the browser and return to the command line..

Return to the terminal session.

Example output:

2023/05/25 09:39:59 No credentials found, proceeding with browser login.
The default web browser has been opened at https://auth.idp.hashicorp.com/oauth2/auth. Please continue the login in the web browser.
Success!
Successfully logged in

Before proceeding with the HCP Vault Secrets CLI, it must be configured. Run vlt init to configure the CLI.
```
$ vlt config init
```

If you are a member of multiple HCP organizations, you will be prompted to select the organization you wish to use. Use the arrow keys to select the HCP organization.

Example output:

Use the arrow keys to navigate: ↓ ↑ → ←
? Multiple Organizations found please select the one you would like to configure.:
  > vault-edu-org
  hashicorp-education
  hashicorp-edu-org

----- Organization -----
Name:   vault-edu-org
ID:     12cd56-88d2-69fb-8cc1-s3sAm3st
State:  ACTIVE

If you have multiple projects in your HCP organization, you will be prompted to select the project you wish to use. Use the arrow keys to select the HCP project.

Use the arrow keys to navigate: ↓ ↑ → ←
? Multiple projects found. Please select the one you would like to configure.:
  DevelopmentProject
  > Production

----- Organization -----
Name:        Production
ID:          12cd56-704c-46af-8ba5-mAtr3x
Description:
State:       ACTIVE

Select the WebApplication application you created in the previous tutorial.

Use the arrow keys to navigate: ↓ ↑ → ←
? Select an Application name:
  ▸ WebApplication
Successfully wrote configuration to system

Run vlt secrets list to review the existing secrets.

$ vlt secrets list
Name      Latest Version  Created At
username  2               2023-05-24T12:22:18.395Z

Non-interactive logins require the use of an HCP service principal and associated key created at the HCP organization level. Project level service principals are not currently supported.

Refer to the HCP Vault Secrets documentation to review HCP roles and permissions.

Open your web browser and log into the HCP Portal
Click Access control (IAM).
Note
If you see the notification Modifying user permissions, click Go to org-name
Click Service principals.
Click Create service principal.
Enter hcp-vault-secrets-tutorial in the Service principal name textbox and click Create service principal.
In the Keys pane, click Create service principal key.
Copy the Client ID.
Return to your terminal and export an environment variable named HCP_CLIENT_ID.
```
$ export HCP_CLIENT_ID=<copied-id>
```
Return to the HCP portal and copy the Client secret.
Return to your terminal and export an environment variable named HCP_CLIENT_SECRET.
```
$ export HCP_CLIENT_SECRET=<copied-secret>
```

Run vlt secrets list to review the existing secrets.

$ vlt secrets list
Name      Latest Version  Created At
username  2               2023-05-24T12:22:18.395Z

Next steps

In this tutorial you installed and configured the HCP Vault Secrets CLI, and authenticated using the interactive and non interactive methods.

In the next tutorial you will learn how to retrieve a secret using the command line interface (CLI) and API which will allow you to automate secret retrieval from HCP Vault Secrets.

Create a secret in HCP Vault Secrets

Retrieve a secret from HCP Vault Secrets