HashiCorp Vault

Detailed information on the HashiCorp Vault secret store component

Create the Vault component

To setup HashiCorp Vault secret store create a component of type secretstores.hashicorp.vault. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4. name: vault
  5. namespace: default
  6. spec:
  7. type: secretstores.hashicorp.vault
  8. version: v1
  9. metadata:
  10. - name: vaultAddr
  11. value: [vault_address] # Optional. Default: "https://127.0.0.1:8200"
  12. - name: caCert # Optional. This or caPath or caPem
  13. value: "[ca_cert]"
  14. - name: caPath # Optional. This or CaCert or caPem
  15. value: "[path_to_ca_cert_file]"
  16. - name: caPem # Optional. This or CaCert or CaPath
  17. value : "[encoded_ca_cert_pem]"
  18. - name: skipVerify # Optional. Default: false
  19. value : "[skip_tls_verification]"
  20. - name: tlsServerName # Optional.
  21. value : "[tls_config_server_name]"
  22. - name: vaultTokenMountPath # Required. Path to token file.
  23. value : "[path_to_file_containing_token]"
  24. - name: vaultKVPrefix # Optional. Default: "dapr"
  25. value : "[vault_prefix]"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

FieldRequiredDetailsExample
vaultAddrNThe address of the Vault server. Defaults to https://127.0.0.1:8200https://127.0.0.1:8200
caCertNCertificate Authority use only one of the options. The encoded cacerts to use“cacerts”
caPathNCertificate Authority use only one of the options. The path to a CA cert file“path/to/cacert/file”
caPemNCertificate Authority use only one of the options. The encoded cacert pem to use“encodedpem”
skipVerifyNSkip TLS verification. Defaults to “false”“true”, “false”
tlsServerNameNTLS config server name“tls-server”
vaultTokenMountPathYPath to file containing token“path/to/file”
vaultKVPrefixNThe prefix in vault. Defautls to “dapr”“dapr”, “myprefix”

Setup Hashicorp Vault instance

Setup Hashicorp Vault using the Vault documentation: https://www.vaultproject.io/docs/install/index.html.

For Kubernetes, you can use the Helm Chart: https://github.com/hashicorp/vault-helm.

Last modified May 26, 2021: Update to point to 1.2 (#1518) (c690379)