Vault Key Ceremony CLI
High-assurance secrets operations should not be tribal shell scripts.
At Swisscom, Vault rekey and generate-root ceremonies depended on PowerShell and Bash scripts that differed by operating system, were hard to version, and were easy to get wrong under pressure.
I designed and implemented a Go CLI that turns those flows into a maintained product:
- Interactive UX with Vault health checks (
/sys/health) and token validation. - Rekey and generate-root flows with human gates on PIN, passphrase and quit — GPG and YubiKey (
keytocard). - One binary for macOS, Linux and Windows; embedded version; publish to the internal artifact store plus a container image; reject if the artifact is not the compiled binary.
- GitLab CI SSDLC: SAST, secret detection, dependency and container scanning, golangci-lint, cross-compile, coverage gate ~95%.
- Tests with JSON fixtures, fake Vault HTTP, and isolated GPG homes.
Stack
Go · Vault Enterprise API · GPG/YubiKey · GitLab CI · Make · Docker · SemVer.
Why it matters
Less human error and less tribal knowledge on the few workflows that must never be casual. Same idea as the rest of my work: turn a security process into a platform other people can operate.
Internal Swisscom tooling — no public repository.