Vault Config Sourcer

Archive Notice

This integration relates to a legacy version of Waypoint and is no longer actively maintained.

Read the blog

Read configuration values from Vault.

Examples

# Setting an input variable dynamically with Vault
variable "my_api_key" {
  default = dynamic("vault", {
    path = "secret/data/keys"
    key  = "/data/my_api_key"
  })
  type        = string
  sensitive   = true
  description = "my api key from vault"
}

# Setting a dynamic variable for an environment variable
config {
  env = {
    "DATABASE_USERNAME" = dynamic("vault", {
      path = "database/creds/my-role"
      key = "username"
    })

    "DATABASE_PASSWORD" = dynamic("vault", {
      path = "database/creds/my-role"
      key = "password"
    })

    # KV Version 2
    "PASSWORD_FOO" = dynamic("vault", {
      path = "secret/data/my-secret"
      key = "/data/password"  # key must be prefixed with "/data" (see below)
    })

    # KV Version 1
    "PASSWORD_BAR" = dynamic("vault", {
      path = "kv1/my-secret"
      key = "password"
    })
  }
}

Parameters

29 Results

addrOptionalstring
The address to the Vault server. If this is not set, the VAULT_ADDR environment variable will be read.
agent_addrOptionalstring
The address to the Vault agent. If this is not set, Vault agent will not be used. This should only be set if you're deploying to an environment with a Vault agent.
approle_role_idOptionalstring
The role ID of the approle auth method to use for Vault. This is required for the approle auth method.
approle_secret_idOptionalstring
The secret ID of the approle auth method to use for Vault. This is required for the approle auth method.
auth_methodOptionalstring
The authentication method to use for Vault. This can be one of: aws, approle, kubernetes, gcp. When this is set, configuration fields prefixed with the auth method type should be set, if required. Configuration fields prefixed with non-matching auth method types will be ignored (except for type validation). If no auth method is set, Vault assumes proper environment variables are set for Vault to find and connect to the Vault server. When this is set, auth_method_mount_path is required.
auth_method_mount_pathOptionalstring
The path where the configured auth method is mounted in Vault. This is required when auth_method is set.
aws_access_keyOptionalstring
The access key to use for authentication to the IAM service, if needed. This usually isn't needed since IAM instance profiles are used.
aws_credential_poll_intervalOptionalint
The interval in seconds to wait before checking for new credentials.
aws_header_valueOptionalstring
The value to match the iam_server_id_header_value if set.
aws_regionOptionalstring
The region for the STS endpoint when using that method of auth.
aws_roleOptionalstring
The role to use for AWS authentication. This is required for the aws auth method. This depends on how you configured the Vault AWS Auth Method.
aws_secret_keyOptionalstring
The secret key to use for authentication to the IAM service, if needed. This usually isn't needed since IAM instance profiles are used.
aws_typeOptionalstring
The type of authentication to use for AWS: either iam or ec2. This is required for the aws auth method. This depends on how you configured the Vault AWS Auth Method.
ca_certOptionalstring
The path to a PEM-encoded CA cert file to use to verify the Vault server SSL certificate.
ca_pathOptionalstring
The path to a directory of PEM-encoded CA cert files to verify the Vault server SSL certificate.
client_certOptionalstring
The path to a PEM-encoded certificate to present as a client certificate. This only needs to be set if Vault is configured to expect a client cert.
client_keyOptionalstring
The path to a private key for the client cert. This only needs to be set if Vault is configured to expect a client cert.
gcp_credentialsOptionalstring
When using static credentials, the contents of the JSON credentials file.
gcp_jwt_expOptionalint
The number of minutes a generated JWT should be valid for when using the iam method.
gcp_projectOptionalstring
The project to use, only if it cannot be automatically determined.
gcp_roleOptionalstring
The role to use for GCP authentication. This is required for the gcp auth method. This depends on how you configured the Vault GCP Auth Method.
gcp_service_accountOptionalstring
The service account to use, only if it cannot be automatically determined.
gcp_typeOptionalstring
The type of authentication; must be gce or iam. This is required for the gcp auth method. This depends on how you configured the Vault GCP Auth Method.
kubernetes_roleOptionalstring
The role to use for Kubernetes authentication. This is required for the kubernetes auth method. This is a role that is setup with the Kubernetes Auth Method in Vault.
kubernetes_token_pathOptionalstring
The path to the Kubernetes service account token. In standard Kubernetes environments, this doesn't have to be set.
namespaceOptionalstring
Default namespace to operate in if you're using Vault namespaces.
skip_verifyOptionalbool
Do not validate the TLS cert presented by the Vault server. This is not recommended unless absolutely necessary.
tls_server_nameOptionalstring
The TLS server name to verify with the Vault server.
tokenOptionalstring
The token to use for communicating to Vault. If you're using a Vault Agent or an auth_method, this may not be necessary. If you're using an auth_method, this may still be necessary as a minimal token with access to the auth method, but usually these are not protected.