|
| 1 | +--- |
| 2 | +title:"Hashicorp Vault" |
| 3 | +description:"How to use secrets from Vault in your Codefresh pipelines" |
| 4 | +group:integrations |
| 5 | +toc:true |
| 6 | +--- |
| 7 | + |
| 8 | +Codefresh can use secrets from your Hashicorp Vault installation. This way you have full control over secret storage and rotation. |
| 9 | + |
| 10 | +>Note: This feature is for Enterprise accounts only. |
| 11 | +
|
| 12 | +###Prerequisites |
| 13 | + |
| 14 | +You need to have a vault instance up and running. Codefresh supports Vault instances that run on the cloud, as well as behind the firewall (albeit with some differences in the authentication methods). |
| 15 | + |
| 16 | +You also need to decide what[authentication method](https://www.vaultproject.io/docs/auth) Codefresh will use. The following methods are supported: |
| 17 | + |
| 18 | +---|--- |
| 19 | +[Username/Password](https://www.vaultproject.io/docs/auth/userpass)|Available in SaaS and Hybrid customers |
| 20 | +[Access Token](https://www.vaultproject.io/docs/auth/token)|Available in SaaS and Hybrid customers |
| 21 | +[Kubernetes](https://www.vaultproject.io/docs/auth/kubernetes)|Only available in[Hybrid installation]({{site.baseurl}}/docs/docs/administration/behind-the-firewall/) |
| 22 | +[Google Cloud Engine](https://www.vaultproject.io/docs/auth/gcp)|Only available in[Hybrid installation]({{site.baseurl}}/docs/docs/administration/behind-the-firewall/) |
| 23 | +[App Role]()|Available in SaaS and Hybrid customers |
| 24 | + |
| 25 | +###Using the Codefresh UI |
| 26 | + |
| 27 | +On the left-hand panel, navigate to**Account Settings** >**Integrations** >**Secret Store** and select**Configure**. |
| 28 | + |
| 29 | +Click on**Add Provider** and select**Hashicorp vault**. Toggle the “allow access to all users” button to the off position as you normally want only Codefresh admins to change vault configuration. |
| 30 | + |
| 31 | +{% include image.html |
| 32 | +lightbox="true" |
| 33 | +file="/images/integrations/hashicorp-vault/hashicorp-vault.png" |
| 34 | +url="/images/integrations/hashicorp-vault/hashicorp-vault.png" |
| 35 | +alt="Hashicorp-vault Secret" |
| 36 | +caption="Hashicorp-vault Secret" |
| 37 | +max-width="80%" |
| 38 | + %} |
| 39 | + |
| 40 | +Enter a name for your integration (you can have multiple vault integrations) unique to this configuration. Then choose if your vault instance is behind a firewall or not. |
| 41 | + |
| 42 | +The rest of the options are specific to your[Vault authentication](https://www.vaultproject.io/docs/auth) method and you should consult the Vault documentation on how to obtain them. |
| 43 | + |
| 44 | +###Using the Codefresh CLI |
| 45 | + |
| 46 | +You can also create Vault integrations with the[CLI](https://codefresh-io.github.io/cli/) and more specifically with the[create context command](https://codefresh-io.github.io/cli/contexts/create-context/create-secret-store-context/hashicorp-vault/). |
| 47 | + |
| 48 | +The available options are the same ones as found in the UI. For example, to create an integration with user/pass authentication the respective command is: |
| 49 | + |
| 50 | +`codefresh create context secret-store hashicorp-vault my-integration --sharing-policy AccountAdmins -app-url http://vault.example.com --username my-user --password my-password` |
| 51 | + |
| 52 | + |
| 53 | +###Using the Secrets |
| 54 | + |
| 55 | +To use the vault secrets in pipelines see our[secrets guide]({{site.baseurl}}/docs/docs/configure-ci-cd-pipeline/secrets-store/). Note that because in Vault, a secret can contain multiple key-value pairs you will need to put in the key name as well. So the syntax will be`{secrets.vault-store-name.path/to/secret@key}` |