Integrate with HashiCorp Vault

FlexDeploy provides out of box integration with HashiCorp Vault to retrieve secrets. FlexDeploy will authenticate using AppRole authentication method against vault.

HashiCorp Vault Setup

You must first install and configure HashiCorp Vault if have not already done so.
Now you can create specific AppRole for FlexDeploy authentication. Use proper role name, for example flexdeploy-role.
AppRole must have policy that allows FlexDeploy to read specific secrets necessary. Note that FlexDeploy only needs read permission. Example policy file
Examplay Policy File
path "kv/*" { capabilities = ["read"] } path "sys/mounts" { capabilities = ["read"] } path "secret/*" { capabilities = ["read"] }
You will need role id and secret id for this AppRole for configuration in FlexDeploy.

FlexDeploy Setup

You must first create Credential Store in FlexDeploy by clicking Create Store button on Administration - Security - Credentials page. Credential store represents instance of specific type of credential store provider. If you have more than one HashiCorp Vault installations, you will create equal number of Credential Stores in FlexDeploy.

Here are the configurations necessary for this store.

Property Name	Notes	Example

Property Name	Notes	Example
Vault URL	HTTP URL for REST service calls. If you use https protocol then make sure to configure KeyStore (default java or application server keystore) with proper certificates.	http://myvault.mycompany.com:8200
App Role Path	App role path for authentication. This will default to approle and it should be sufficient.	approle
Role Id	You will create approle for FlexDeploy to authenticate against vault, provide role id here.	as per your Vault configurations
Secret Id	You will create approle for FlexDeploy to authenticate against vault, provide secret id here.	as per your Vault configurations
Engine Version	Engine version for secrets. This will default to 2, you can change if necessary.	1 or 2

Now you are ready to create individual credential to be retrieved from Vault.

You can create or edit credentials from Credentials page or from where specific credential is used.

HashiCorp Credential requires two inputs as described below. Keep in mind that AppRole created for FlexDeploy must have read access to paths defined by various credentials.

Input Name	Notes

Input Name	Notes
Secrets Path	Path to secrets in HashiCorp Vault. For example, kv/DEV/Database/apps
Key Name	Key name for secret value.

Here is how edit credential looks like.

Create credential looks similar except you need to provide Scope as well. Scope can not changed once credential is saved.

You can change credential inputs (Secrets Path, Key Name) at any point. FlexDeploy will use these inputs with credential store properties like URL, Role and Secret id to retrieve individual credential for use during Workflow Execution.