Maintaining Versioned Keys in Vault

maintenance.sh

#!/bin/bash

# Create a temporary orphaned Vault Token with
# permissions to make changes to the /versions mountpoint VTK=$(vault token-create ... ) 
# Get a list of the levels of the /versions mount
# and previous end date for tokens 
MOUNTS=$(vault list /versions | sed 1,2d)
OLDER_THAN=$(date --date="6 days ago" +"%Y%m%d%H%M%S")
for mount in $MOUNTS; do 
   # Get a list of our "apps"
   # in this case it would be "single/" and "multi/"
   APP=$(vault list /versions/$mount | sed 1,2d)
   for app in $APPS; do 
      # Get a list of all of our "versions"
      VERSIONS=$(vault list /versions/$mount$app | sed 1,2d | grep [0-9])
      for version in $VERSIONS; do
      # Based on $OLDER_THAN set above, this essentially 
      # is checking if the secret should be deleted.
      # Here we are saying if the secret is older than 
      # a week ago, and if so it should be wiped out.
         let STATE=$version-$OLDER_THAN
         if [ $STATE -le 1000000 ]; then 
            vault delete /versions/$mount$namespace$app$version 
         fi
      done
   done
done
# Revoke your created vault temporary token
vault token-revoke $VTK