SecretsProvider
Uses the specified secret stores to resolve queried secrets, such as passwords and cryptographic keys. Attempts to resolve the secret with the secret stores in the order that they are declared in the array.
Usage
{
"name": string,
"type": "SecretsProvider",
"config": {
"stores": [ SecretStore reference, ... ]
}
}This object can alternatively be configured in a compact format, without the SecretsProvider declaration, as follows:
-
With an inline secret store:
"secretsProvider": { "type": "secret store type1", "config": {...} } -
With multiple inline secret stores:
"secretsProvider": [ { "type": "secret store type1", "config": {...} }, { "type": "secret store type2", "config": {...} } ] -
With a referenced secret store:
"secretsProvider": "mySecretStore1" -
With multiple referenced secret stores:
"secretsProvider": [ "mySecretStore1", "mySecretStore2" ]
See Example for more example configurations.
Properties
"stores": array of SecretStore references, required-
One or more secret stores to provide access to stored secrets. Configure secret stores described in Secrets.
Example
The following SecretsProvider is used in Discover and dynamically register with OpenID connect providers.
"secretsProvider": {
"type": "SecretsProvider",
"config": {
"stores": [
{
"type": "KeyStoreSecretStore",
"config": {
"file": "/path/to/keystore.p12",
"mappings": [
{
"aliases": [ "myprivatekeyalias" ],
"secretId": "private.key.jwt.signing.key"
}
],
"storePasswordSecretId": "keystore.secret.id",
"storeType": "PKCS12",
"secretsProvider": "SystemAndEnvSecretStore-1"
}
}
]
}
}The following example shows the equivalent SecretsProvider configuration with an inline compact format:
"secretsProvider": {
"name": "KeyStoreSecretStore-1",
"type": "KeyStoreSecretStore",
"config": {
"file": "/path/to/keystore.p12",
"mappings": [
{
"aliases": [ "myprivatekeyalias" ],
"secretId": "private.key.jwt.signing.key"
}
],
"storePasswordSecretId": "keystore.secret.id",
"storeType": "PKCS12",
"secretsProvider": "SystemAndEnvSecretStore-1"
}
}The following example shows the equivalent SecretsProvider configuration with a compact format, referencing a KeyStoreSecretStore object in the heap:
"secretsProvider": "KeyStoreSecretStore-1"