Skip to main content

Hashicorp Vault secret store

Type: secretstores.hashicorp.vault

Status: stable

Reference: https://docs.dapr.io/reference/components-reference/supported-secret-stores/hashicorp-vault/

Example​

apiVersion: cra.diagrid.io/v1beta1
kind: Component
metadata:
  name: <name>
spec:
  type: secretstores.hashicorp.vault
  version: v1
  metadata:
    # Token for authentication within Vault.
    - name: vaultToken
      value: "tokenValue"
    # Authentication method. Defaults to "token" for this authentication profile. (Optional)
    #- name: vaultAuthMethod
    #  value: "token"
    # The path to the CA certificate to use, in PEM format. (Optional)
    #- name: caCert
    #  value: | 
    #    path/to/cacert.pem
    # The inlined contents of the CA certificate to use, in PEM format. If defined, takes precedence over "caPath" and "caCert". (Optional)
    #- name: caPem
    #  value: | 
    #    -----BEGIN PUBLIC KEY-----
    #    ...Base64 encoding of the DER encoded certificate...
    #    -----END PUBLIC KEY-----
    #    
    # The engine path in vault. (Optional)
    #- name: enginePath
    #  value: "secret"
    # Skip TLS verification. (Optional)
    #- name: skipVerify
    #  value: "false"
    # The name of the server requested during TLS handshake in order to support virtual hosting. This value is also used to verify the TLS certificate presented by Vault server. (Optional)
    #- name: tlsServerName
    #  value: "tls-server"
    # The address of the Vault server. (Optional)
    #- name: vaultAddr
    #  value: "https://127.0.0.1:8200"
    # The prefix in vault. (Optional)
    #- name: vaultKVPrefix
    #  value: "dapr"
    # If false, vaultKVPrefix is forced to be empty. If the value is not given or set to true, vaultKVPrefix is used when accessing the vault. Setting it to false is needed to be able to use the BulkGetSecret method of the store. (Optional)
    #- name: vaultKVUsePrefix
    #  value: "true"
    # Vault value type. map means to parse the value into map[string]string, text means to use the value as a string. "map" sets the multipleKeyValuesPerSecret behavior. text makes Vault behave as a secret store with name/value semantics. (Optional)
    #- name: vaultValueType
    #  value: "map"

Authentication profiles​

Available authentication profiles:

  • Token

  • Token file

  • Kubernetes

Token​

Authenticate using a static Vault token.

vaultToken (string)​

Required - Token for authentication within Vault.

Example value: tokenValue

vaultAuthMethod (string)​

Authentication method. Defaults to "token" for this authentication profile.

Default value: token

Example value: token

Allowed values:

  • token

Token file​

Authenticate using a Vault token read from a file.

vaultAuthMethod (string)​

Authentication method. Defaults to "token" for this authentication profile.

Default value: token

Example value: token

Allowed values:

  • token

Kubernetes​

Authenticate using the Vault Kubernetes auth method and the pod's service account token.

vaultAuthMethod (string)​

Required - Authentication method. This must be set to "kubernetes" for this authentication profile.

Example value: kubernetes

Allowed values:

  • kubernetes

vaultKubernetesRole (string)​

Required - The Vault role to authenticate as.

Example value: my-app-role

vaultKubernetesMountPath (string)​

The mount path of the Kubernetes auth method in Vault.

Default value: kubernetes

Example value: kubernetes

vaultServiceAccountTokenPath (string)​

Path to the Kubernetes service account token.

Default value: /var/run/secrets/kubernetes.io/serviceaccount/token

Example value: /var/run/secrets/kubernetes.io/serviceaccount/token

Metadata​

caCert (string)​

The path to the CA certificate to use, in PEM format.

Example value:

path/to/cacert.pem

caPem (string)​

The inlined contents of the CA certificate to use, in PEM format. If defined, takes precedence over "caPath" and "caCert".

Example value:

-----BEGIN PUBLIC KEY-----\n...Base64 encoding of the DER encoded certificate...\n-----END PUBLIC KEY-----

enginePath (string)​

The engine path in vault.

Default value: secret

Example value: kv

skipVerify (string)​

Skip TLS verification.

Default value: false

Example value: true

tlsServerName (string)​

The name of the server requested during TLS handshake in order to support virtual hosting. This value is also used to verify the TLS certificate presented by Vault server.

Example value: tls-server

vaultAddr (string)​

The address of the Vault server.

Default value: https://127.0.0.1:8200

Example value: https://127.0.0.1:8200

vaultKVPrefix (string)​

The prefix in vault.

Default value: dapr

Example value: myprefix

vaultKVUsePrefix (bool)​

If false, vaultKVPrefix is forced to be empty. If the value is not given or set to true, vaultKVPrefix is used when accessing the vault. Setting it to false is needed to be able to use the BulkGetSecret method of the store.

Example value: true

vaultValueType (string)​

Vault value type. map means to parse the value into map[string]string, text means to use the value as a string. "map" sets the multipleKeyValuesPerSecret behavior. text makes Vault behave as a secret store with name/value semantics.

Default value: map

Example value: map

Last updated on