# Hashicorp Vault secret store

Type: `secretstores.hashicorp.vault`

Status: stable

Reference: https://docs.dapr.io/reference/components-reference/supported-secret-stores/hashicorp-vault/

## Example

```
apiVersion: cra.diagrid.io/v1beta1
kind: Component
metadata:
  name: <name>
spec:
  type: secretstores.hashicorp.vault
  version: v1
  metadata:
    # Token for authentication within Vault.
    - name: vaultToken
      value: "tokenValue"
    # Authentication method. Defaults to "token" for this authentication profile. (Optional)
    #- name: vaultAuthMethod
    #  value: "token"
    # The path to the CA certificate to use, in PEM format. (Optional)
    #- name: caCert
    #  value: | 
    #    path/to/cacert.pem
    # The inlined contents of the CA certificate to use, in PEM format. If defined, takes precedence over "caPath" and "caCert". (Optional)
    #- name: caPem
    #  value: | 
    #    -----BEGIN PUBLIC KEY-----
    #    ...Base64 encoding of the DER encoded certificate...
    #    -----END PUBLIC KEY-----
    #    
    # The engine path in vault. (Optional)
    #- name: enginePath
    #  value: "secret"
    # Skip TLS verification. (Optional)
    #- name: skipVerify
    #  value: "false"
    # The name of the server requested during TLS handshake in order to support virtual hosting. This value is also used to verify the TLS certificate presented by Vault server. (Optional)
    #- name: tlsServerName
    #  value: "tls-server"
    # The address of the Vault server. (Optional)
    #- name: vaultAddr
    #  value: "https://127.0.0.1:8200"
    # The prefix in vault. (Optional)
    #- name: vaultKVPrefix
    #  value: "dapr"
    # If false, vaultKVPrefix is forced to be empty. If the value is not given or set to true, vaultKVPrefix is used when accessing the vault. Setting it to false is needed to be able to use the BulkGetSecret method of the store. (Optional)
    #- name: vaultKVUsePrefix
    #  value: "true"
    # Vault value type. map means to parse the value into map[string]string, text means to use the value as a string. "map" sets the multipleKeyValuesPerSecret behavior. text makes Vault behave as a secret store with name/value semantics. (Optional)
    #- name: vaultValueType
    #  value: "map"

```

## Authentication profiles

Available authentication profiles:

- Token

- Token file

- Kubernetes

### Token

Authenticate using a static Vault token.

#### `vaultToken` (string)

**Required** - Token for authentication within Vault.

Example value: `tokenValue`

#### `vaultAuthMethod` (string)

Authentication method. Defaults to "token" for this authentication profile.

Default value: `token`

Example value: `token`

Allowed values:

- token

### Token file

Authenticate using a Vault token read from a file.

#### `vaultAuthMethod` (string)

Authentication method. Defaults to "token" for this authentication profile.

Default value: `token`

Example value: `token`

Allowed values:

- token

### Kubernetes

Authenticate using the Vault Kubernetes auth method and the pod's service account token.

#### `vaultAuthMethod` (string)

**Required** - Authentication method. This must be set to "kubernetes" for this authentication profile.

Example value: `kubernetes`

Allowed values:

- kubernetes

#### `vaultKubernetesRole` (string)

**Required** - The Vault role to authenticate as.

Example value: `my-app-role`

#### `vaultKubernetesMountPath` (string)

The mount path of the Kubernetes auth method in Vault.

Default value: `kubernetes`

Example value: `kubernetes`

#### `vaultServiceAccountTokenPath` (string)

Path to the Kubernetes service account token.

Default value: `/var/run/secrets/kubernetes.io/serviceaccount/token`

Example value: `/var/run/secrets/kubernetes.io/serviceaccount/token`

## Metadata

### `caCert` (string)

The path to the CA certificate to use, in PEM format.

Example value:

```
path/to/cacert.pem
```

### `caPem` (string)

The inlined contents of the CA certificate to use, in PEM format. If defined, takes precedence over "caPath" and "caCert".

Example value:

```
-----BEGIN PUBLIC KEY-----\n...Base64 encoding of the DER encoded certificate...\n-----END PUBLIC KEY-----

```

### `enginePath` (string)

The engine path in vault.

Default value: `secret`

Example value: `kv`

### `skipVerify` (string)

Skip TLS verification.

Default value: `false`

Example value: `true`

### `tlsServerName` (string)

The name of the server requested during TLS handshake in order to support virtual hosting. This value is also used to verify the TLS certificate presented by Vault server.

Example value: `tls-server`

### `vaultAddr` (string)

The address of the Vault server.

Default value: `https://127.0.0.1:8200`

Example value: `https://127.0.0.1:8200`

### `vaultKVPrefix` (string)

The prefix in vault.

Default value: `dapr`

Example value: `myprefix`

### `vaultKVUsePrefix` (bool)

If false, vaultKVPrefix is forced to be empty. If the value is not given or set to true, vaultKVPrefix is used when accessing the vault. Setting it to false is needed to be able to use the BulkGetSecret method of the store.

Example value: `true`

### `vaultValueType` (string)

Vault value type. map means to parse the value into map\[string]string, text means to use the value as a string. "map" sets the multipleKeyValuesPerSecret behavior. text makes Vault behave as a secret store with name/value semantics.

Default value: `map`

Example value: `map`