HashiCorp Vault

Detailed information on the HashiCorp Vault secret store component

Setup Hashicorp Vault instance

Setup Hashicorp Vault using the Vault documentation: https://www.vaultproject.io/docs/install/index.html.

For Kubernetes, you can use the Helm Chart: https://github.com/hashicorp/vault-helm.

Create the Vault component

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4.   name: vault
  5.   namespace: default
  6. spec:
  7.   type: secretstores.hashicorp.vault
  8.   version: v1
  9.   metadata:
  10.   - name: vaultAddr
  11.     value: [vault_address] # Optional. Default: "https://127.0.0.1:8200"
  12.   - name: caCert # Optional. This or caPath or caPem
  13.     value: "[ca_cert]"
  14.   - name: caPath # Optional. This or CaCert or caPem
  15.     value: "[path_to_ca_cert_file]"
  16.   - name: caPem # Optional. This or CaCert or CaPath
  17.     value : "[encoded_ca_cert_pem]"
  18.   - name: skipVerify # Optional. Default: false
  19.     value : "[skip_tls_verification]"
  20.   - name: tlsServerName # Optional.
  21.     value : "[tls_config_server_name]"
  22.   - name: vaultTokenMountPath # Required. Path to token file.
  23.     value : "[path_to_file_containing_token]"
  24.   - name: vaultKVPrefix # Optional. Default: "dapr"
  25.     value : "[vault_prefix]"

To run locally, create a components dir containing the YAML file and provide the path to the dapr run command with the flag --components-path.

To deploy in Kubernetes, save the file above to vault.yaml and then run:

  1. kubectl apply -f vault.yaml

Example

This example shows you how to take the Redis password from the Vault secret store.

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4.   name: statestore
  5.   namespace: default
  6. spec:
  7.   type: state.redis
  8.   version: v1
  9.   metadata:
  10.   - name: redisHost
  11.     value: "[redis]:6379"
  12.   - name: redisPassword
  13.     secretKeyRef:
  14.       name: redisPassword
  15.       key: redisPassword
  16. auth:
  17.     secretStore: vault

Related links

Last modified February 16, 2021: Merge pull request #1235 from dapr/update-v0.11 (b4e9fbb)