Config Sourcer

Vault Config Sourcer

Parameters

The address to the Vault server.
If this is not set, the VAULT_ADDR environment variable will be read.

The address to the Vault agent.
If this is not set, Vault agent will not be used. This should only be set if you're deploying to an environment with a Vault agent.

The role ID of the approle auth method to use for Vault.
This is required for the `approle` auth method.

The secret ID of the approle auth method to use for Vault.
This is required for the `approle` auth method.

The authentication method to use for Vault.
This can be one of: `aws`, `approle`, `kubernetes`, `gcp`. When this is set, configuration fields prefixed with the auth method type should be set, if required. Configuration fields prefixed with non-matching auth method types will be ignored (except for type validation).  If no auth method is set, Vault assumes proper environment variables are set for Vault to find and connect to the Vault server. When this is set, `auth_method_mount_path` is required.

The path where the configured auth method is mounted in Vault.
This is required when `auth_method` is set.

The access key to use for authentication to the IAM service, if needed.
This usually isn't needed since IAM instance profiles are used.

The interval in seconds to wait before checking for new credentials.

The value to match the [`iam_server_id_header_value`](/vault/api-docs/auth/aws#iam_server_id_header_value) if set.

The region for the STS endpoint when using that method of auth.

The role to use for AWS authentication.
This is required for the `aws` auth method. This depends on how you configured the Vault [AWS Auth Method](/vault/docs/auth/aws).

The secret key to use for authentication to the IAM service, if needed.
This usually isn't needed since IAM instance profiles are used.

The type of authentication to use for AWS: either `iam` or `ec2`.
This is required for the `aws` auth method. This depends on how you configured the Vault [AWS Auth Method](/vault/docs/auth/aws).

The path to a PEM-encoded CA cert file to use to verify the Vault server SSL certificate.

The path to a directory of PEM-encoded CA cert files to verify the Vault server SSL certificate.

The path to a PEM-encoded certificate to present as a client certificate.
This only needs to be set if Vault is configured to expect a client cert.

The path to a private key for the client cert.
This only needs to be set if Vault is configured to expect a client cert.

When using static credentials, the contents of the JSON credentials file.

The number of minutes a generated JWT should be valid for when using the iam method.

The project to use, only if it cannot be automatically determined.

The role to use for GCP authentication.
This is required for the `gcp` auth method. This depends on how you configured the Vault [GCP Auth Method](/vault/docs/auth/gcp).

The service account to use, only if it cannot be automatically determined.

The type of authentication; must be `gce` or `iam`.
This is required for the `gcp` auth method. This depends on how you configured the Vault [GCP Auth Method](/vault/docs/auth/gcp).

The role to use for Kubernetes authentication.
This is required for the `kubernetes` auth method. This is a role that is setup with the [Kubernetes Auth Method in Vault](/vault/docs/auth/kubernetes).

The path to the Kubernetes service account token.
In standard Kubernetes environments, this doesn't have to be set.

Default namespace to operate in if you're using Vault namespaces.

Do not validate the TLS cert presented by the Vault server.
This is not recommended unless absolutely necessary.

The TLS server name to verify with the Vault server.

The token to use for communicating to Vault.
If you're using a Vault Agent or an `auth_method`, this may not be necessary. If you're using an `auth_method`, this may still be necessary as a minimal token with access to the auth method, but usually these are not protected.

Components

Developer

Waypoint

Integrations

Vault

The Vault plugin reads configuration values from Vault.

This integration is shipped in the core product and does not need to be installed.

Built-in

Our community conference is taking place in San Francisco and online October 10-12.

A curated collection of official, partner, and community Waypoint Integrations.