Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secrets-Sync/vault-18673-documentation #23189

Merged
merged 39 commits into from
Sep 27, 2023
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
f113e17
* secrets sync doc initial setup
maxcoulombe Sep 19, 2023
f0e91be
Add VSCode debug bin to gitignore
robmonte Sep 20, 2023
03895e4
+ added missing endpoint doc
maxcoulombe Sep 20, 2023
43ab088
Merge remote-tracking branch 'origin/main' into sync/vault-18673-docu…
maxcoulombe Sep 20, 2023
bcafe21
Begin writing doc info
robmonte Sep 20, 2023
ea9a959
More docs
robmonte Sep 21, 2023
1417bfe
Merge branch 'sync/vault-18673-documentation' of ssh://github.com/has…
robmonte Sep 21, 2023
185d4ec
* added GCP destination doc
maxcoulombe Sep 22, 2023
2303fa5
* enhanced the TF instructions a bit
maxcoulombe Sep 22, 2023
e39dffb
Merge remote-tracking branch 'origin/sync/vault-18673-documentation' …
maxcoulombe Sep 22, 2023
12f9343
* sections as sentence case
maxcoulombe Sep 22, 2023
d184160
* typo
maxcoulombe Sep 22, 2023
179ad02
More docs
robmonte Sep 25, 2023
cc35a18
Moving AWS and Index pages into separate PR
robmonte Sep 25, 2023
b7294f4
Update website/content/docs/sync/gcpsm.mdx
maxcoulombe Sep 25, 2023
4cc3e9d
Secrets Sync Docs - format clean up suggestions (#23267)
yhyakuna Sep 25, 2023
0c812cd
add secret sync for github docs (#23266)
raymonstah Sep 26, 2023
4516324
add secret sync for azure kv docs (#23255)
raymonstah Sep 26, 2023
d6fb287
+ added Vercel doc (#23261)
maxcoulombe Sep 26, 2023
41b4ca2
Add AWS and Index pages (#23276)
robmonte Sep 26, 2023
f91253f
Merge branch 'main' into sync/vault-18673-documentation
maxcoulombe Sep 26, 2023
65d6574
Update website/content/api-docs/system/secrets-sync.mdx
maxcoulombe Sep 26, 2023
4293919
Format & style updates (#23289)
yhyakuna Sep 26, 2023
19723af
* adjustments
maxcoulombe Sep 26, 2023
c6e9020
Merge remote-tracking branch 'origin/sync/vault-18673-documentation' …
maxcoulombe Sep 26, 2023
a821c7d
Sync docs formatting consistency (#23291)
robmonte Sep 26, 2023
81aaab8
* tidying & normalisation
maxcoulombe Sep 26, 2023
3e0ab1c
Merge remote-tracking branch 'origin/sync/vault-18673-documentation' …
maxcoulombe Sep 26, 2023
e71694e
* fix merge
maxcoulombe Sep 26, 2023
b350b52
Fix quotations on environment variable names and fix sentence to corr…
robmonte Sep 26, 2023
bec112d
* small typos
maxcoulombe Sep 26, 2023
250ed35
Merge remote-tracking branch 'origin/sync/vault-18673-documentation' …
maxcoulombe Sep 26, 2023
c58c2e2
Merge branch 'main' into sync/vault-18673-documentation
maxcoulombe Sep 26, 2023
79a777a
+ add enterprise alert
maxcoulombe Sep 26, 2023
0ed80aa
Minor fixes (#23307)
yhyakuna Sep 27, 2023
4de7b5c
Fix format language tags
robmonte Sep 27, 2023
04859f2
Fix more things dropped from the earlier merge conflict
robmonte Sep 27, 2023
819a802
Update association description
robmonte Sep 27, 2023
16fead6
Remove plural when only 1 step preceeds
robmonte Sep 27, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Format & style updates (#23289)
  • Loading branch information
yhyakuna authored Sep 26, 2023
commit 4293919d42e27ecedeeb81b9e3461512ca54778e
42 changes: 30 additions & 12 deletions website/content/docs/sync/azurekv.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,20 @@ which gives sufficient access to manage secrets. For more information, see the [
When Azure credentials for the service principal have been obtained and it has access to Azure Key Vault,
Vault can be configured to create an Azure destination, then begin to associate your secrets with this destination.

1. Configure the sync destination:
1. Configure the sync destination.

```shell-session
$ vault write sys/sync/stores/azure-kv/my-azure-1 \
key_vault_uri=$KEY_VAULT_URI \
client_id=$CLIENT_ID \
client_secret=$CLIENT_SECRET \
tenant_id=$TENANT_ID
key_vault_uri=$KEY_VAULT_URI \
client_id=$CLIENT_ID \
client_secret=$CLIENT_SECRET \
tenant_id=$TENANT_ID
```

Output:
**Output:**

<CodeBlockConfig hideClipboard>

```text
Key Value
--- -----
Expand All @@ -43,14 +47,20 @@ Vault can be configured to create an Azure destination, then begin to associate
type azure-kv
```

</CodeBlockConfig>

## Usage

1. Store any KV secret into Vault, like so:
1. Store your KV secret into Vault.

```shell-session
$ vault kv put secret/foo mypass=bar
```

Output:
**Output:**

<CodeBlockConfig hideClipboard>

```
=== Secret Path ===
secret/data/foo
Expand All @@ -65,14 +75,20 @@ Vault can be configured to create an Azure destination, then begin to associate
version 1
```

1. Set a secret to be associated with the configured secret destination:
</CodeBlockConfig>

1. Set a secret to be associated with the configured secret destination.

```shell-session
$ vault write sys/sync/destinations/azure-kv/my-azure-1/associations/set \
mount='secret' \
secret_name='foo'
mount='secret' \
secret_name='foo'
```

Output:
**Output:**

<CodeBlockConfig hideClipboard>

```
Key Value
--- -----
Expand All @@ -81,6 +97,8 @@ Vault can be configured to create an Azure destination, then begin to associate
store_type azure-kv
```

</CodeBlockConfig>

1. Navigate to [Azure Key Vault](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults) in the Azure portal
to confirm your secret was successfully created.

Expand Down
46 changes: 34 additions & 12 deletions website/content/docs/sync/github.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ This is a low footprint option that enables your applications to benefit from Va
to connect directly with Vault. This guide walks you through the configuration process.

Prerequisites:

* Ability to read or create KVv2 secrets
* Ability to create GitHub fine-grained or personal tokens with access to modify repository secrets
* Ability to create sync destinations and associations on your Vault server
Expand All @@ -27,12 +28,16 @@ and allow "Read and Write" access to the repository secrets.
When credentials for GitHub have been obtained, and it has access to manage secrets in your repository,
Vault can be configured to create a GitHub destination, then begin to associate your secrets with this destination.

1. Store any KV secret into Vault, like so:
1. Store any KV secret into Vault.

```shell-session
$ vault kv put secret/foo mypass=bar
```

Output:
**Output:**

<CodeBlockConfig hideClipboard>

```
=== Secret Path ===
secret/data/foo
Expand All @@ -47,15 +52,21 @@ Vault can be configured to create a GitHub destination, then begin to associate
version 1
```

1. Configure the sync destination:
</CodeBlockConfig>

1. Configure the sync destination.

```shell-session
$ vault write sys/sync/destinations/gh/my-gh-1 \
access_token=$ACCESS_TOKEN \
repository_owner=$REPOSITORY_OWNER \
repository_name=$REPOSITORY_NAME
access_token=$ACCESS_TOKEN \
repository_owner=$REPOSITORY_OWNER \
repository_name=$REPOSITORY_NAME
```

Output:
**Output:**

<CodeBlockConfig hideClipboard>

```text
Key Value
--- -----
Expand All @@ -64,14 +75,20 @@ Vault can be configured to create a GitHub destination, then begin to associate
type gh
```

1. Set a secret to be associated with the configured secret destination:
</CodeBlockConfig>

1. Set a secret to be associated with the configured secret destination.

```shell-session
$ vault write sys/sync/destinations/gh/my-gh-1/associations/set \
mount='secret' \
secret_name='foo'
mount='secret' \
secret_name='foo'
```

Output:
**Output:**

<CodeBlockConfig hideClipboard>

```
Key Value
--- -----
Expand All @@ -80,13 +97,15 @@ Vault can be configured to create a GitHub destination, then begin to associate
store_type gh
```

</CodeBlockConfig>

1. Navigate to your GitHub repository settings to confirm your secret was successfully created.

Moving forward, any modification on the Vault secret will be propagated in near real time to its GitHub repository secrets
counterpart. Creating a new secret version in Vault will create a new version in GitHub. Deleting the secret
or the association in Vault will delete the secret in GitHub as well.

## Notes
<Note>

GitHub only supports single value secrets, so KVv2 secrets from Vault will be stored as a JSON string.
In the example above, the value for secret "foo" will be synced to GitHub as the JSON string `{"mypass":"bar"}`.
Expand All @@ -96,6 +115,9 @@ When synced to GitHub:
* Secret names with unsupported characters will be replaced by an "_".
* Secret names are capitalized, and case-insensitive.

</Note>


## API

Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
38 changes: 30 additions & 8 deletions website/content/docs/sync/vercelproject.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -26,27 +26,39 @@ Prerequisites:

```shell-session
$ vault write sys/sync/destinations/vercel-project/my-dest \
access_token=<token> \
project_id=<project-id> \
deployment_environments=development \
deployment_environments=preview \
deployment_environments=production
access_token=<token> \
project_id=<project-id> \
deployment_environments=development \
deployment_environments=preview \
deployment_environments=production
```

**Output:**

<CodeBlockConfig hideClipboard>

```plaintext
Key Value
--- -----
connection_details map[access_token:***** deployment_environments:[development preview production] project_id:<project-id>]
name my-dest
type vercel-project
```

</CodeBlockConfig>

## Usage

1. If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine and create a secret.
1. If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine.

```shell-session
$ vault secrets enable -path=my-kv kv-v2
Success! Enabled the kv-v2 secrets engine at: my-kv/
```

1. Store any KV secret into Vault.

```shell-session
$ vault kv put -mount=my-kv my-secret foo=bar
==== Secret Path ====
my-kv/data/my-secret
Expand All @@ -61,18 +73,28 @@ Prerequisites:
version 1
```

1. Create an association between your Vercel Project destination and the secret to synchronize
1. Create an association between your Vercel Project destination and the secret to synchronize.

```shell-session
vault write sys/sync/destinations/vercel-project/my-dest/associations/set mount=my-kv secret_name=my-secret
$ vault write sys/sync/destinations/vercel-project/my-dest/associations/set \
mount=my-kv \
secret_name=my-secret
```

**Output:**

<CodeBlockConfig hideClipboard>

```plaintext
Key Value
--- -----
associated_secrets map[kv_1234/my-secret:map[accessor:kv_1234 secret_name:my-secret sync_status:SYNCED updated_at:<timestamp>>]]
store_name my-dest
store_type vercel-project
```

</CodeBlockConfig>

1. Navigate to your project's settings under the `Environment Variables` section to confirm your secret was successfully
created in your Vercel project.

Expand Down