kedacore/keda

Add support for Hashicorp Vault Transit

开放

#3,128 创建于 2022年6月6日

 (2 条评论) (0 个反应) (0 位负责人)Go (1,457 个派生)auto 404
featurehelp wantedneeds-discussion

仓库指标

星标
 (10,372 个星标)
PR 合并指标
 (平均合并 8天 8小时) (30 天内合并 94 个 PR)

描述

Proposal

KEDA Auth supports Hashicorp vault as secret backend but only stores plaintext password in KV v2.

Suggestion to add 1 more parameter to allow the credentials to be encrypted.

hashiCorpVault:                                                      # Optional.
  address: {hashicorp-vault-address}                      # Required.
  namespace: {hashicorp-vault-namespace}          # Optional. Default is root namespace. Useful for Vault Enterprise
  authentication: token | kubernetes                       # Required.
  role: {hashicorp-vault-role}                                   # Optional.
  mount: {hashicorp-vault-mount}                           # Optional.
+  transitKey: {hashicorp-vault-transit-key-name}    # If null, skip decryption.
  credential:                                                            # Optional.
    token: {hashicorp-vault-token}                           # Optional.
    serviceAccount: {path-to-service-account-file}  # Optional.
  secrets:                                                                # Required.
  - parameter: {scaledObject-parameter-name}    # Required.
    key: {hasicorp-vault-secret-key-name}              # Required.
    path: {hasicorp-vault-secret-path}                     # Required.

Use-Case

Our security team has a policy where we're not allowed to store plaintext password in Hashicorp Vault. It has to be in encrypted value.

Anything else?

No response

贡献者指南