Vault Configuration

The current helm chart support is provided for Hashicorp Vault annotations and use of the Hashicorp injector. More information on Hashicorp Vault annotations can be found here.

Vault Secret Values

An example vault values section looks like:

  vault:
    enabled: true
    hashicorp:
      annotations:
        role: {hashicorp-vault-role}
      secretPrefix: {path to secret}
      secrets:
        {secret-name}:
          {secret-key | to-json}:
            path: /opt/in/some/location/secrets
            file: devops-secret.env

The vault.hashicorp.secrets is a map that specifies each secret to pull from the vault. And for each secret, a map specifies the key to pull with instructions of where to place the secret based on path and file

License Parameters	Description	Default Value
secrets.{secret}	map of secret	devops-secret
secrets.{secret}.{key}	map of key	pingaccess.lic
secrets.{secret}.{key}.path	optional: location of secret. Defaults to vault.annotation.secret-volume-path	/opt/in/some/path
secrets.{secret}.{key}.file	required: file name secrets placed into	pingaccess.lic

Special key name (to-json)

There is a special key name that can be provided that will drop the raw secret into the container as it's json representation with all the secret key names/values.

If dropped into the SECRETS_DIR (defaults to /run/secrets) directory, these files will be processed as:

• PROPERTY_FILE if the file ends in .env or
• Multiple files will be created for each key=value pair.

See the example below in this document for the transformation that occurs with the devops-secret.env.

Vault Annotations

Default yaml defined in the global vault section. The options of annotation names/values can be found at vault definitions

For each of the annotations, the helm chart will automatically pre-pend the annotation with the hashicorp annotation prefix of vault.hashicorp.com. See example below.

global:
  vault:
    enabled: false
    hashicorp:
      annotations:
        agent-inject: true
        agent-init-first: true
        agent-pre-populate-only: true
        log-level: info
        preserve-secret-case: true
        role: k8s-default
        secret-volume-path: /run/secrets
        serviceAccountName: vault-auth

Example

The following includes an example Hashicorp Vault secrets as well as a value values .yaml that make use of the secrets and an example of where secrets will be placed into container.

Example: Hashicorp Vault secrets

SECRET:secrets/jsmith@example.com/jsmith-namespace/licenses

{
  "pingaccess-6.2": "Product=PingAccess\nVersion=6.2...",
  "pingdirectory-8.2": "Product=PingDirectory\nVersion=8.2...",
  "pingfederate-10.2": "Product=PingFederate\nVersion=10.2..."
}

SECRET: secrets/jsmith@example.com/jsmith-namespace/devops-secrets.env

{
  "PING_IDENTITY_ACCEPT_EULA": "YES",
  "PING_IDENTITY_DEVOPS_KEY": "d254....-....-...-...-............",
  "PING_IDENTITY_DEVOPS_USER": "jsmith@example.com"
}

SECRET: secrets/jsmith@example.com/jsmith-namespace/certs

{
  "tls.crt": "LS0tLS1CRUdJ...a9dk",
  "tls.key": "LS0tLS1CRUdJ...38sj"
}

Example: Vault secrets .yaml

pingfederate-admin:
  vault:
    hashicorp:
      secrets:
        devops-secret.env:
          to-json:
            file: devops-secret.env
        licenses:
          pingaccess-6.2:
            file: pingaccess.lic
            path: /opt/in/some/location/licenses
        test-certs:
          to-json:
            file: test-certs

Places the following files into the container:

Example: Container files

FILE: /run/secrets/devops-secret.env

PING_IDENTITY_ACCEPT_EULA="YES"
PING_IDENTITY_DEVOPS_KEY="d254....-....-...-...-............"
PING_IDENTITY_DEVOPS_USER="jsmith@example.com"

FILE: /opt/in/some/location/licenses/pingaccess.lic

Product=PingAccess
Version=6.2
...

FILE: /run/secrets/tls.crt

LS0tLS1CRUdJ...a9dk

FILE: /run/secrets/tls.key

LS0tLS1CRUdJ...38sj