Vault configuration
This integration will store secrets in the Vault KV Secrets Engine - Version 2. Kestra authentications must have full read and write policies on this secrets store. You can optionally change root-engine
or namespace
(if you use Vault Enterprise).
Authentication
Password authentication
You can use a Userpass Auth Method using the following configuration:
kestra:
secret:
type: vault
vault:
address: "http://localhostt:8200"
password:
user: john
password: foo
Token authentication
You can use a Token Auth Method using the following configuration:
kestra:
secret:
type: vault
vault:
address: "http://localhostt:8200"
token:
token: your-secret-token
AppRole authentication
You can use an AppRole Auth Method using the following configuration:
kestra:
secret:
type: vault
vault:
address: "http://localhostt:8200"
app-role:
path: approle
role-id: your-role-id
secret-id: your-secret-id
Others configurations
kestra.secret.vault.address
The fully qualified address with scheme and port to your Vault instance.
kestra.secret.vault.namespace
Optional. Sets a global namespace to the Vault server instance. Namespace support requires Vault Enterprise Pro.
kestra.secret.vault.engine-version
Optional. Sets the KV Secrets Engine version of the Vault server instance. Default is 2
.
kestra.secret.vault.root-engine
Optional. Sets the KV Secrets Engine of the Vault server instance. Default is secret
.