SecretsProvider
Uses the specified secret stores to resolve queried secrets, such as passwords and cryptographic keys. Attempts to resolve the secret with the secret stores in the order that they are declared in the array.
Usage
{
"name": string,
"type": "SecretsProvider",
"config": {
"stores": [ secret store declaration, ... ]
}
}This object can alternatively be configured in a compact format, without the SecretsProvider declaration, as follows:
With an inline secret store:
"secretsProvider": { "type": "secret store type1", "config": {...} }With multiple inline secret stores:
"secretsProvider": [ { "type": "secret store type1", "config": {...} } { "type": "secret store type2", "config": {...} } ]With a referenced secret store:
"secretsProvider": "mySecretStore1"
With multiple referenced secret stores:
"secretsProvider": [ "mySecretStore1", "mySecretStore2" ]
See "Example" for more example configurations.
Properties
"stores": array of secret store declarations, requiredOne or more secret stores to provide access to stored secrets. Configure secret stores described in Secret Stores.
Example
The following SecretsProvider is used in "Dynamic Registration With OpenID Connect Providers".
"secretsProvider": {
"type": "SecretsProvider",
"config": {
"stores": [
{
"type": "KeyStoreSecretStore",
"config": {
"file": "/path/to/keystore.jks",
"mappings": [
{
"aliases": [ "myprivatekeyalias" ],
"secretId": "private.key.jwt.signing.key"
}
],
"storePassword": "keystore.secret.id",
"storeType": "JKS",
"secretsProvider": "SystemAndEnvSecretStore-1"
}
}
]
}
}The following example shows the equivalent SecretsProvider configuration with an inline compact format:
"secretsProvider": {
"name": "KeyStoreSecretStore-1",
"type": "KeyStoreSecretStore",
"config": {
"file": "/path/to/keystore.jks",
"mappings": [
{
"aliases": [ "myprivatekeyalias" ],
"secretId": "private.key.jwt.signing.key"
}
],
"storePassword": "keystore.secret.id",
"storeType": "JKS"
}
}The following example shows the equivalent SecretsProvider configuration with a compact format, referencing a KeyStoreSecretStore object in the heap:
"secretsProvider": "KeyStoreSecretStore-1"