HashiCorp Vault

Detailed information on the HashiCorp Vault secret store component

Create the Vault component

To setup HashiCorp Vault secret store create a component of type secretstores.hashicorp.vault. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4.   name: vault
  5. spec:
  6.   type: secretstores.hashicorp.vault
  7.   version: v1
  8.   metadata:
  9.   - name: vaultAddr
  10.     value: [vault_address] # Optional. Default: "https://127.0.0.1:8200"
  11.   - name: caCert # Optional. This or caPath or caPem
  12.     value: "[ca_cert]"
  13.   - name: caPath # Optional. This or CaCert or caPem
  14.     value: "[path_to_ca_cert_file]"
  15.   - name: caPem # Optional. This or CaCert or CaPath
  16.     value : "[encoded_ca_cert_pem]"
  17.   - name: skipVerify # Optional. Default: false
  18.     value : "[skip_tls_verification]"
  19.   - name: tlsServerName # Optional.
  20.     value : "[tls_config_server_name]"
  21.   - name: vaultTokenMountPath # Required if vaultToken not provided. Path to token file.
  22.     value : "[path_to_file_containing_token]"
  23.   - name: vaultToken # Required if vaultTokenMountPath not provided. Token value.
  24.     value : "[path_to_file_containing_token]"
  25.   - name: vaultKVPrefix # Optional. Default: "dapr"
  26.     value : "[vault_prefix]"
  27.   - name: vaultKVUsePrefix # Optional. default: "true"
  28.     value: "[true/false]"
  29.   - name: enginePath # Optional. default: "secret"
  30.     value: "secret"
  31.   - name: vaultValueType # Optional. default: "map"
  32.     value: "map"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

FieldRequiredDetailsExample
vaultAddrNThe address of the Vault server. Defaults to “https://127.0.0.1:8200““https://127.0.0.1:8200“
caCertNCertificate Authority use only one of the options. The encoded cacerts to use“cacerts”
caPathNCertificate Authority use only one of the options. The path to a CA cert file“path/to/cacert/file”
caPemNCertificate Authority use only one of the options. The encoded cacert pem to use“encodedpem”
skipVerifyNSkip TLS verification. Defaults to “false”“true”, “false”
tlsServerNameNTLS config server name“tls-server”
vaultTokenMountPathYPath to file containing token“path/to/file”
vaultTokenYToken for authentication within Vault.“tokenValue”
vaultKVPrefixNThe prefix in vault. Defaults to “dapr”“dapr”, “myprefix”
vaultKVUsePrefixNIf false, vaultKVPrefix is forced to be empty. If the value is not given or set to true, vaultKVPrefix is used when accessing the vault. Setting it to false is needed to be able to use the BulkGetSecret method of the store.“true”, “false”
enginePathNThe engine path in vault. Defaults to “secret”“kv”, “any”
vaultValueTypeNVault value type. map means to parse the value into map[string]string, text means to use the value as a string. Defaults to “map”“map”, “text”

Setup Hashicorp Vault instance

Setup Hashicorp Vault using the Vault documentation: https://www.vaultproject.io/docs/install/index.html.

For Kubernetes, you can use the Helm Chart: https://github.com/hashicorp/vault-helm.

Last modified July 27, 2022: Remove namespace element from component examples (#2647) (ff9de5c8)