retrieve_azure_vault_secret.rb

#!/bin/env ruby

# Load the native Ruby HTTP libraries
require 'net/http'
require 'json'

# Get an API key to access our vault(s)
# Note that the machine must have been granted access to the vault using managed identity
apikey_uri = URI('http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net')
req = Net::HTTP::Get.new(apikey_uri)
req['Metadata'] = true
res = Net::HTTP.start(apikey_uri.hostname, apikey_uri.port) {|http|
  http.request(req)
}

# Extract the API token from the response body
api_token = JSON.parse(res.body)['access_token']

# Retrieve a vault item named "ldap-password" from a vault name "sekrits"
# The machine must be granted access to the vault using managed identity
vault_uri = URI('https://sekrits.vault.azure.net/secrets/ldap-password?api-version=7.0')
req = Net::HTTP::Get.new(vault_uri)
req['Metadata'] = true
req['Authorization'] = "Bearer #{api_token}"
req['Content-Type'] = 'application/json'
res = Net::HTTP.start(vault_uri.hostname, vault_uri.port, use_ssl:true) {|http|
  http.request(req)
}

# Extract the ldap-password secret from the response body
ldap_password = JSON.parse(res.body)['value']

puts ldap_password