Improve this page on GitHub

Hashicorp Vault

How to use secrets from Vault in your Codefresh pipelines

Codefresh can use secrets from your Hashicorp Vault installation. This way you have full control over secret storage and rotation.

Note: This feature is for Enterprise accounts only.

Prerequisites

You need to have a vault instance up and running. Codefresh supports Vault instances that run on the cloud, as well as behind the firewall (albeit with some differences in the authentication methods).

You also need to decide what authentication method Codefresh will use. The following methods are supported:

Username/Password Available in SaaS and Hybrid customers
Access Token Available in SaaS and Hybrid customers
Kubernetes Only available in Hybrid installation
Google Cloud Engine Only available in Hybrid installation
App Role Available in SaaS and Hybrid customers

Using the Codefresh UI

On the left-hand panel, navigate to Account Settings > Integrations > Secret Store and select Configure.

Click on Add Provider and select Hashicorp vault. Toggle the “allow access to all users” button to the off position as you normally want only Codefresh admins to change vault configuration.

Hashicorp-vault Secret

Hashicorp-vault Secret

Enter a name for your integration (you can have multiple vault integrations) unique to this configuration. Then choose if your vault instance is behind a firewall or not.

The rest of the options are specific to your Vault authentication method and you should consult the Vault documentation on how to obtain them.

Using the Codefresh CLI

You can also create Vault integrations with the CLI and more specifically with the create context command.

The available options are the same ones as found in the UI. For example, to create an integration with user/pass authentication the respective command is:

codefresh create context secret-store hashicorp-vault my-integration --sharing-policy AccountAdmins -app-url http://vault.example.com --username my-user --password my-password

Using the Secrets

To use the vault secrets in pipelines see our secrets guide. Note that because in Vault, a secret can contain multiple key-value pairs you will need to put in the key name as well. So the syntax will be {secrets.vault-store-name.path/to/[email protected]}