Integrate with HashiCorp Vault

FlexDeploy provides out of box integration with HashiCorp Vault to retrieve secrets. FlexDeploy will authenticate using AppRole authentication method against vault.

HashiCorp Vault Setup

• You must first install and configure HashiCorp Vault if have not already done so.
• Now you can create specific AppRole for FlexDeploy authentication.

• AppRole specific to FlexDeploy must have policy assigned that allows FlexDeploy to read specific secrets necessary. Example policy file

  Examplay Policy File

  path "kv/*" 
  {
     capabilities = ["read", "update"]
  }
  path "sys/mounts" 
  {
     capabilities = ["read"]
  } 
  path "secret/*"
  {
    capabilities = ["create", "read", "update", "delete", "list"]
  }

• You will need role id and secret id for this AppRole for configuration in FlexDeploy.

FlexDeploy Setup

You must first create Credential Store in FlexDeploy by clicking Create Store button on Administration - Security - Credentials page. Credential store represents instance of specific type of credential store provider. If you have more than one HashiCorp Vault installations, you will create equal number of Credential Stores in FlexDeploy.

Here are the configurations necessary for this store.