Project: SPIRE (Provisioning / Key Management)
File: plugin_server_upstreamauthority_vault.md

The vault plugin signs intermediate CA certificates for SPIRE using the Vault PKI Engine. The plugin does not support the `PublishJWTKey` RPC and is therefore not appropriate for use in nested SPIRE topologies where JWT-SVIDs are in use. The plugin accepts the following configuration options: | key | type | required | description | default | |:|:-|:|:--|:| | vaultaddr | string | | The URL of the Vault server. (e.g., <https://vault.example.com:8443/>) | `${VAULTADDR}` | | namespace | string | | Name of the Vault namespace. This is only available in the Vault Enterprise. | `${VAULT_NAMESPACE}` | | pkimountpoint | string | | Name of the mount point where PKI secret engine is mounted | pki | | cacertpath | string | | Path to a CA certificate file used to verify the Vault server certificate. Only PEM format is supported. | `${VAULT_CACERT}` | | insecureskipverify | bool | | If true, vault client accepts any server certificates | false | | cert_auth | struct | | Configuration for the Client Certificate authentication method | | | token_auth | struct | | Configuration for the Token authentication method | | | approle_auth | struct | | Configuration for the AppRole authentication method | | | k8s_auth | struct | | Configuration for the Kubernetes authentication method | | The plugin supports Client Certificate, Token and AppRole authentication methods. Client Certificate method authenticates to Vault using a TLS client certificate. Token method authenticates to Vault using the token in a HTTP Request header. AppRole method authenticates to Vault using a RoleID and SecretID that are issued from Vault. The should be less than or equal to the Vault's PKI secret engine TTL. To configure the TTL value, tune the engine. e.g. ```shell $ vault secrets tune -max-lease-ttl=8760h pki ``` The configured token needs to be attached to a policy that has at least the following capabilities: ```hcl path "pki/root/sign-intermediate" { capabilities = ["update"] } ``` | key | type | required | description | default | |:-|:-|:|:|:--| | certauthmount_point | string | | Name of the mount point where TLS certificate auth method is mounted | cert | | certauthrole_name | string | | Name of the Vault role. If given, the plugin authenticates against only the named role. Default to trying all roles. | | | clientcertpath | string | | Path to a client certificate file. Only PEM format is supported. | `${VAULTCLIENTCERT}` | | clientkeypath | string | | Path to a client private key file. Only PEM format is supported. | `${VAULTCLIENTKEY}` | ```hcl UpstreamAuthority "vault" { plugin_data { vault_addr =

pkimountpoint = "test-pki" cacertpath = "/path/to/ca-cert.pem" cert_auth { certauthmount_point = "test-tls-cert-auth" clientcertpath = "/path/to/client-cert.pem" clientkeypath = "/path/to/client-key.pem" } // If specify the role to authenticate with // cert_auth { // certauthmount_point = "test-tls-cert-auth" // certauthrole_name = "test" // clientcertpath = "/path/to/client-cert.pem" // clientkeypath = "/path/to/client-key.pem" // } // If specify the key-pair as an environment variable and use the modified mount point // cert_auth { // certauthmount_point = "test-tls-cert-auth" // } // If specify the key-pair as an environment variable and use the default mount point, set the empty structure. // cert_auth {} } } ``` | key | type | required | description | default | |:|:-|:|:|:--| | token | string | | Token string to set into "X-Vault-Token" header | `${VAULT_TOKEN}` | ```hcl UpstreamAuthority "vault" { plugin_data { vault_addr = "https://vault.example.org/" pkimountpoint = "test-pki" cacertpath = "/path/to/ca-cert.pem" token_auth { token = "<token>" } // If specify the token as an environment variable, set the empty structure. // token_auth {} } } ``` | key | type | required | description | default | |:-|:-|:|:--|:--| | approleauthmount_point | string | | Name of the mount point where the AppRole auth method is mounted | approle | | approleid | string | | An identifier of AppRole | `${VAULTAPPROLE_ID}` | | approlesecretid | string | | A credential of AppRole | `${VAULTAPPROLESECRET_ID}` | ```hcl UpstreamAuthority "vault" { plugin_data { vault_addr = "https://vault.example.org/" pkimountpoint = "test-pki" cacertpath = "/path/to/ca-cert.pem" approle_auth { approleauthmount_point = "my-approle-auth" approle_id = "<Role ID>" // or specified by environment variables approlesecretid = "<Secret ID>" // or specified by environment variables } // If specify the approleid and approlesecret as an environment variable and use the modified mount point // approle_auth { // approleauthmount_point = "my-approle-auth" // } // If specify the approleid and approlesecret as an environment variable and use the default mount point, set the empty structure. // approle_auth {} } } ``` | key | type | required | description | default | |:|:-|:|:-|:--| | k8sauthmount_point | string | | Name of the mount point where the Kubernetes auth method is mounted | kubernetes | | k8sauthrole_name | string | | Name of the Vault role. The plugin authenticates against the named role | | | token_path | string | | Path to the Kubernetes Service Account Token to use authentication with the Vault | | ```hcl UpstreamAuthority "vault" { plugin_data { vault_addr = "https://vault.example.org/" pkimountpoint = "test-pki" cacertpath = "/path/to/ca-cert.pem" k8s_auth { k8sauthmount_point = "my-k8s-auth" k8sauthrole_name = "my-role" token_path = "/path/to/sa-token" } // If specify role name and use the default mount point and token_path // k8s_auth { // k8sauthrole_name = "my-role" // } } } ```