Secret

This component is optional and is responsible for integrating with an external secret system based off the configuration provided.

The secret system is used by Vela for storing sensitive application data at rest.

By default, Vela will use the database to store the sensitive data if no other secret system is configured.

note

Any sensitive data stored in the database will be encrypted using the Advanced Encryption Standard (AES).

Configuration

The following options are used to configure the component:

Name	Description	Required	Default	Environment Variables
secret.vault.addr	fully qualified url to the HashiCorp Vault instance	true	N/A	SECRET_VAULT_ADDR`VELA_SECRET_VAULT_ADDR`
secret.vault.auth-method	authentication method used to obtain token from the HashiCorp Vault instance	false	N/A	SECRET_VAULT_AUTH_METHOD`VELA_SECRET_VAULT_AUTH_METHOD`
secret.vault.aws-role	HashiCorp Vault role used to connect to the auth/aws/login endpoint	false	N/A	SECRET_VAULT_AWS_ROLE`VELA_SECRET_VAULT_AWS_ROLE`
secret.vault.driver	enables HashiCorp Vault as a secret engine	true	false	SECRET_VAULT`VELA_SECRET_VAULT`
secret.vault.prefix	prefix for k/v secrets in the HashiCorp Vault instance	false	N/A	SECRET_VAULT_PREFIX`VELA_SECRET_VAULT_PREFIX`
secret.vault.renewal	frequency to renew the token for the HashiCorp Vault instance	false	30m	SECRET_VAULT_RENEWAL`VELA_SECRET_VAULT_RENEWAL`
secret.vault.token	token required to access the HashiCorp Vault instance	true	N/A	SECRET_VAULT_TOKEN`VELA_SECRET_VAULT_TOKEN`
secret.vault.version	version for the k/v backend for the HashiCorp Vault instance	true	2	SECRET_VAULT_VERSION`VELA_SECRET_VAULT_VERSION`

note

For more information on these configuration options, please see the server reference.

Drivers

The following drivers are available to configure the component:

Name	Description	Documentation
vault	uses a HashiCorp Vault instance for storing sensitive data at rest	https://www.vaultproject.io/

HashiCorp Vault

From the HashiCorp Vault official website:

HashiCorp Vault enables you to secure, store and tightly control access to tokens, passwords, certificates, encryption keys for protecting secrets and other sensitive data using a UI, CLI, or HTTP API.

The below configuration displays an example of starting the Vela server that will connect to a HashiCorp Vault instance:

$ docker run \
  --detach=true \
  --env=VELA_ADDR=https://vela-server.example.com \
  --env=VELA_DATABASE_ENCRYPTION_KEY=<encryption-key> \
  --env=VELA_QUEUE_DRIVER=redis \
  --env=VELA_QUEUE_ADDR=redis://<password>@<hostname>:<port>/<database> \
  --env=VELA_PORT=443 \
  --env=VELA_SECRET=<shared-secret> \
  --env=VELA_SERVER_PRIVATE_KEY=<private_key> \
+ --env=VELA_SECRET_VAULT=true \
+ --env=VELA_SECRET_VAULT_ADDR=https://vault.example.com \
+ --env=VELA_SECRET_VAULT_TOKEN=<vault-token>
  --env=VELA_SCM_CLIENT=<oauth-client-id> \
  --env=VELA_SCM_SECRET=<oauth-client-secret> \
  --env=VELA_WEBUI_ADDR=https://vela.example.com \
  --name=server \
  --publish=80:80 \
  --publish=443:443 \
  --restart=always \
  target/vela-server:latest