You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Securely load database credentials from HashiCorp Vault.
9
+
10
+
Each database in the config file may be configured to use HashiCorp Vault. To load the database username and/or password from HashiCorp Vault, set the `vault.hashicorp` property to contain the following information:
11
+
12
+
```yaml
13
+
databases:
14
+
mydb:
15
+
vault:
16
+
hashicorp:
17
+
proxySocket: /var/run/vault/vault.sock
18
+
mountType: secret engine type, currently either "kvv1" or "kvv2"
19
+
mountName: secret engine mount path
20
+
secretPath: path of the secret
21
+
usernameAttribute: name of the JSON attribute, where to read the database username, if ommitted defaults to "username"
22
+
passwordAttribute: name of the JSON attribute, where to read the database password, if ommitted defaults to "password"
23
+
```
24
+
25
+
Example
26
+
27
+
```yaml
28
+
databases:
29
+
mydb:
30
+
vault:
31
+
hashicorp:
32
+
proxySocket: /var/run/vault/vault.sock
33
+
mountType: kvv2
34
+
mountName: dev
35
+
secretPath: oracle/mydb/monitoring
36
+
```
37
+
38
+
### Authentication
39
+
40
+
In this first version it currently only supports queries via HashiCorp Vault Proxy configured to run on the local host and listening on a Unix socket. Currently also required use_auto_auth_token option to be set.
41
+
Will expand the support for other methods in the future.
42
+
43
+
Example Vault Proxy configuration snippet:
44
+
45
+
```
46
+
listener "unix" {
47
+
address = "/var/run/vault/vault.sock"
48
+
socket_mode = "0660"
49
+
socket_user = "vault"
50
+
socket_group = "vaultaccess"
51
+
tls_disable = true
52
+
}
53
+
54
+
api_proxy {
55
+
# This always uses the auto_auth token when communicating with Vault server, even if client does not send a token
0 commit comments