Vault provider implementation #32
ramizpolic
started this conversation in
Ideas
Replies: 1 comment
-
I also found 2 environment variable that uses solution-specific formatting, but it is provider-specific:
Source: BV-Docs It should be changed to provider-specific formatting, therefore used with |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Summary
To add Vault provider in a way that is backwards compatible between secret-init and vault-env, we need to consider the way they handle configuration flows.
Vault-env
Solution specific configs use
VAULT_ENV_*
env format with the exceptions ofVAULT_LOG_LEVEL
andVAULT_LOG_JSON
Provider specific configs use
VAULT_*
env format (note that the only supported provider is Vault)Secret-init
SECRET_INIT_*
env formatBackwards compatibility will not be respected for these configs between vault-env due to standard differences.
For example, using
VAULT_ENV_*
(or evenVAULT_LOG_LEVEL
) to configure secret-init does not make much sense.We can easily compile a list of different vars between the two solutions for tracking.
{PROVIDER}_
env format. In addition,{provider}:
prefix in a given env variable value indicates which provider needs to perform the injection/env substituion.File provider can use
FILE_
env name prefix for its configs andfile:
env value prefix to indicate its usage. For example:FILE_MOUNT_PATH=/secrets
INJECTED_VIA_FILE=file:example
(note that the actual host path is/secrets/example
)Vault provider can use
VAULT_
env name prefix for its configs andvault:
env value prefix to indicate its usage. For example:VAULT_ADDR=http://vault
,VAULT_TOKEN_FILE=/path/to/token
INJECTED_VIA_VAULT=vault:secret/data/example#KEY
With this approach, we preserve backwards compatibility between vault-env and secret-init related to the actual Vault provider.
However, please note that other env value prefixes are supported by vault-sdk/injector (e.g.
>>vault:
) which needs to be further checked.Notes
Implementation
SECRET_INIT_
)Beta Was this translation helpful? Give feedback.
All reactions