kedacore/keda

Add support for Hashicorp Vault Transit

Open

#3,128 opened on Jun 6, 2022

 (2 comments) (0 reactions) (0 assignees)Go (1,457 forks)auto 404
featurehelp wantedneeds-discussion

Repository metrics

Stars
 (10,372 stars)
PR merge metrics
 (PR metrics pending)

Description

Proposal

KEDA Auth supports Hashicorp vault as secret backend but only stores plaintext password in KV v2.

Suggestion to add 1 more parameter to allow the credentials to be encrypted.

hashiCorpVault:                                                      # Optional.
  address: {hashicorp-vault-address}                      # Required.
  namespace: {hashicorp-vault-namespace}          # Optional. Default is root namespace. Useful for Vault Enterprise
  authentication: token | kubernetes                       # Required.
  role: {hashicorp-vault-role}                                   # Optional.
  mount: {hashicorp-vault-mount}                           # Optional.
+  transitKey: {hashicorp-vault-transit-key-name}    # If null, skip decryption.
  credential:                                                            # Optional.
    token: {hashicorp-vault-token}                           # Optional.
    serviceAccount: {path-to-service-account-file}  # Optional.
  secrets:                                                                # Required.
  - parameter: {scaledObject-parameter-name}    # Required.
    key: {hasicorp-vault-secret-key-name}              # Required.
    path: {hasicorp-vault-secret-path}                     # Required.

Use-Case

Our security team has a policy where we're not allowed to store plaintext password in Hashicorp Vault. It has to be in encrypted value.

Anything else?

No response

Contributor guide