Hashicorp Vault
How to use secrets from Vault in your Codefresh pipelines
Codefresh can use secrets from your Hashicorp Vault installation. This way you have full control over secret storage and rotation.
Note: This feature is for Enterprise accounts only.
Prerequisites
You need to have a vault instance up and running. Codefresh supports Vault instances that run on the cloud, as well as behind the firewall (albeit with some differences in the authentication methods).
You also need to decide what authentication method Codefresh will use. The following methods are supported:
| Method | Notes |
|---|---|
| Username/Password | Available in SaaS and Hybrid customers |
| Access Token | Available in SaaS and Hybrid customers |
| Kubernetes | Only available in Hybrid installation |
| Google Cloud Engine | Only available in Hybrid installation |
| App Role | Available in SaaS and Hybrid customers |
Using the Codefresh UI
On the left-hand panel, navigate to Account Settings > Integrations > Secret Store and select Configure.
Click on Add Provider and select Hashicorp vault. Toggle the “allow access to all users” button to the off position as you normally want only Codefresh admins to change vault configuration.
Enter a name for your integration (you can have multiple vault integrations) unique to this configuration. Then choose if your vault instance is behind a firewall or not.
The rest of the options are specific to your Vault authentication method and you should consult the Vault documentation on how to obtain them.
Using the Codefresh CLI
You can also create Vault integrations with the CLI and more specifically with the create context command.
The available options are the same ones as found in the UI. For example, to create an integration with user/pass authentication the respective command is:
codefresh create context secret-store hashicorp-vault my-integration --sharing-policy AccountAdmins -app-url http://vault.example.com --username my-user --password my-password
Using the Secrets
To use the vault secrets in pipelines see our secrets guide. Note that because in Vault, a secret can contain multiple key-value pairs you will need to put in the key name as well. So the syntax will be {secrets.vault-store-name.path/to/secret@key}