kedacore/keda

Add support for Hashicorp Vault Transit

Aperta

#3128 aperta il 6 giu 2022

 (2 commenti) (0 reazioni) (0 assegnatari)Go (1457 fork)auto 404
featurehelp wantedneeds-discussion

Metriche repository

Star
 (10.372 stelle)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

Proposal

KEDA Auth supports Hashicorp vault as secret backend but only stores plaintext password in KV v2.

Suggestion to add 1 more parameter to allow the credentials to be encrypted.

hashiCorpVault:                                                      # Optional.
  address: {hashicorp-vault-address}                      # Required.
  namespace: {hashicorp-vault-namespace}          # Optional. Default is root namespace. Useful for Vault Enterprise
  authentication: token | kubernetes                       # Required.
  role: {hashicorp-vault-role}                                   # Optional.
  mount: {hashicorp-vault-mount}                           # Optional.
+  transitKey: {hashicorp-vault-transit-key-name}    # If null, skip decryption.
  credential:                                                            # Optional.
    token: {hashicorp-vault-token}                           # Optional.
    serviceAccount: {path-to-service-account-file}  # Optional.
  secrets:                                                                # Required.
  - parameter: {scaledObject-parameter-name}    # Required.
    key: {hasicorp-vault-secret-key-name}              # Required.
    path: {hasicorp-vault-secret-path}                     # Required.

Use-Case

Our security team has a policy where we're not allowed to store plaintext password in Hashicorp Vault. It has to be in encrypted value.

Anything else?

No response

Guida contributor