CLI tool to diff and audit changes between HashiCorp Vault secret versions across environments.
go install github.com/yourusername/vaultdiff@latestOr build from source:
git clone https://github.com/yourusername/vaultdiff.git
cd vaultdiff
go build -o vaultdiff .Compare two versions of a secret within the same Vault path:
vaultdiff --path secret/myapp/config --v1 3 --v2 5Diff secrets across environments:
vaultdiff --src secret/staging/myapp --dst secret/production/myappExport a diff report to a file:
vaultdiff --path secret/myapp/config --v1 2 --v2 4 --output report.json| Flag | Description |
|---|---|
--path |
Vault secret path |
--v1 |
First version to compare |
--v2 |
Second version to compare |
--src |
Source environment path |
--dst |
Destination environment path |
--output |
Write diff output to a file |
--format |
Output format: text (default), json, or yaml |
--token |
Vault token (or set VAULT_TOKEN) |
--addr |
Vault address (or set VAULT_ADDR) |
--mask |
Mask secret values in output (shows *** instead of plaintext) |
- Go 1.21+
- HashiCorp Vault with KV v2 secrets engine
MIT © 2024 Your Name