Skip to content
Reference
Configuration files
The secrets providers file

The secrets providers file

-secrets-config: this orchestrator’s own secrets providers. It names where each provider is and how this orchestrator signs in there, by the files that hold its secret zero, and never holds a secret itself: a field it does not know, such as a token, is refused.

providers:
  - id: vault
    type: vault
    site: dc1
    address: https://vault.dc1.example:8200
    ca_file: /etc/qfence/vault/ca.pem
    mounts:
      - {path: secret, kv_version: 2}
      - {path: database, engine: leased}
    auth:
      method: cert
      cert_file: /etc/qfence/vault/dc1.pem
      key_file: /etc/qfence/vault/dc1-key.pem
  - id: aws
    type: aws-secrets-manager
    site: dc1
    region: eu-central-1

An AWS Secrets Manager provider signs in with the host’s own identity only (ADR 0011 §11), so its auth names no file at all.

  • providers (list of object): This orchestrator’s providers, at least one.

providers[]

One provider of -secrets-config. Relative file paths are relative to the file’s own directory.

  • id (string): The provider name references use (vault:PATH); local and cluster are qfence’s own stores.
  • type (string): “vault” or “aws-secrets-manager”.
  • site (string): The site the provider serves. A binding that resolves through a provider at another site than the orchestrator’s is warned of (ADR 0011 §6).
  • address (string): The server’s URL; for AWS Secrets Manager, unset means the region’s public endpoint.
  • ca_file (string): ca_file verifies the server’s certificate (PEM); unset means the system’s roots.
  • namespace (string): A Vault Enterprise or HCP Vault namespace.
  • mounts (list of object): The secrets engines a Vault provider reads.
  • region (string): AWS Secrets Manager’s region, such as eu-central-1.
  • auth (object): How this orchestrator signs in to the provider.

providers[].mounts[]

One engine a Vault provider reads.

  • path (string): Where the engine is mounted, such as secret or database. A reference’s path starts with it: vault:secret/qfence/fgt is the secret qfence/fgt on the mount secret.
  • engine (string): “kv” (the default), or “leased” for an engine whose every read is a new credential with a lease, such as the database engine.
  • kv_version (integer): A kv engine’s version, 1 or 2; unset means 2.

providers[].auth

How the orchestrator signs in to a provider: VaultAuth’s fields, each secret by the file that holds it; for AWS Secrets Manager, method instance (the default) and where the instance metadata service is.

  • method (string): method is, for a Vault, “cert” (the default: a client certificate), “approle”, or “token” (a static token, for development only); for AWS Secrets Manager, “instance”.
  • mount (string): Where the Vault auth method is mounted; unset means cert or approle, as the method.
  • role (string): The cert role to sign in as; unset lets Vault pick the role the certificate matches.
  • cert_file (string): cert_file and key_file are the client certificate (PEM, its chain after it) and its private key, for cert.
  • key_file (string): cert_file and key_file are the client certificate (PEM, its chain after it) and its private key, for cert.
  • role_id_file (string): role_id_file and secret_id_file hold AppRole’s role id and secret id, for approle.
  • secret_id_file (string): role_id_file and secret_id_file hold AppRole’s role id and secret id, for approle.
  • token_file (string): token_file holds a static token, for token.
  • metadata_address (string): The instance metadata service, for AWS; unset means http://169.254.169.254.
The configuration file