Skip to main content

Integrating with HashiCorp Vault

In the context of Adeptia Automate, you can use HashiCorp Vault to fetch the credentials associated with an activity at runtime. To achieve this, you must set the HashiCorp Vault related parameters in the global values.yaml file.

If you have deployed Adeptia Automate using the Adeptia Connect Rancher package, refer to the Additional configurations section to configure the variables discussed on this page.

The following table contains the list of parameters and their description.

ParameterDescription
configManagement:
PROFILE:The Profile in Hashicorp Vault that you want to

use for fetching the secrets.

A Profile in Vault is used for grouping the secrets

based on the type of environment, for example

Dev, QA, or Prod.

This ensures that the secrets associated with

the specified Profile, and thus with the specific environment, are fetched.
CONFIG_MANAGEMENT_SEGREGATION_CRITERIA:The variable to define the basis for the segregation

of your secrets.

The value for this variable is either project (in case of project based segregation) or it can be left blank.
backend:
hashicorp:
HASHICORP_VAULT_ENABLED:Set this variable to true to fetch the secrets from HashiCorp Vault.
HASHICORP_VAULT_KV_VERSION:The variable to define the version of the kv secret engine.



The possible values are v1 and v2.
HASHICORP_VAULT_SECRET_PATH_PATTERN:The pattern of the path for the secrets stored in the Vault.

The default value for this variable is:

$PROJECT_VAULT_MAPPING$/$PROFILE$

/$PROJECT_NAME$

Where,

•
$PROJECT_VAULT_MAPPING$ must
be included in the pattern if you have used project mapping.

•
$PROFILE$ must be included in the
 pattern if you have used profiles in Vault
for grouping the secrets based on the type
of environment.

•
$PROJECT_NAME$ must be included in
the pattern if you have used project folders
in the Vault.




HASHICORP_VAULT_URL:Access URL (endpoint) of the HashiCorp Vault.
HASHICORP_VAULT_SECRET_BASE_PATH:Enter the complete path to the base folder that

contains secrets.




HASHICORP_VAULT_AUTHENTICATION:Enter the type of authentication to be used by
AC application to authenticate to the Vault.

The possible values are KUBERNETES and
TOKEN.
HASHICORP_VAULT_TOKEN:Enter the Vault token.


HASHICORP_VAULT_KUBERNETES_ROLE:Enter the name of the role associated with the Kubernetes authentication method you have
defined in the Vault.


HASHICORP_VAULT_KUBERNETES_SERVICE

_ACC_TOKEN_PATH:		Enter the path where the Service Account
token is stored within the pod.

The default value for this variable is /var/run/secrets/kubernetes.io/serviceaccount/token.


HASHICORP_VAULT_KUBERNETES_PATH:Enter the name of Kubernetes authentication method defined in the Vault.


HASHICORP_VAULT_TOKEN_TYPEEnter the type of token defined in the Kubernetes authentication method.



The possible values for this variable are:

• batch
• service
WarningYou need to restart the runtime (shared and dedicated) pods if you redeploy the application with an updated value for a HashiCorp parameter.