Secret Management Configuration

Configuring the Secret Management

By default the secret-manager service is not deployed as part of the PAA, in order to use the Secret-Management Service you need to activate/enable it by adding the following section to the values-custom.yaml:

secrets-mgmt:
  enabled: false
  replicaCount: 1
  command: []
  # Allows you to add any config files to /app/config
  plainIDConfig:
    config.yaml:
      server:
        port: 8080
      # Which IP is allowed to make requests to secret-mgmt
        bindIp: 0.0.0.0
      management:
        port: 8081
      log:
        level: jwksinfo" #debug,trace
        format: "json"
        logTo: "console" # rolling, file
      rabbitmq:
        enabled: false
      gin:
        mode: release  # debug, release
      # Secret Store configuration
      secretStore:
        - id: fileSecret
          type: File
          isDefault: true
          decoder: Base64
          details:
            path: /app/config/filename.txt
# Examples below for HashiCorp Vault and Environment Variables based Secret Stores
#       - id: vault
#         type: Vault
#         isDefault: true
#         decoder: None # Base64, None
#         details:
#           PathPrefix: prefix
#           defaultPath: vault_
#           skipVerify: true
#           url: vault
#           timeout: 3s
#           enginePath: custom
#           # Authentication method should use either a Token or Kubernetes authentication method with vault
#         auth:
#           method: Token # Token, Kubernetes
#           tokenValue: token
#           tokenFileName: ${ VAULT_TOKEN }  - instead of token value
#         auth:
#           method: Kubernetes
#           path: /var/path-to-file/file.txt
#           role: secrets-mgmt
#       - id: ENV_VAR_SECRET
#          type: Environment
#          isDefault: false
#          decoder: Base64
#          details:
#            name: ENV_VAR_SECRET

Activating/Enabling the Secret Management Service

In order to enable the Secret Management Service, set the secrets-mgmt.enabled to true

Optional Settings for the Secret Management Service

Configure a Secret Store

The Secret Store is used to obtain the relevant secrets (e.g. Private Keys) from.
The Secret Management Service supports the following Secret Store Types:
HashiCorp Vault
Environment Variables
Text File

General Vault Parameters

secretStore:
 - id: vault
   type: Vault
   isDefault: true
   Decoder: None # Base64, None
   details:
     defaultPath: vault_
     skipVerify: true
     url: vault
     timeout: 3s
     enginePath: custom
     pathPrefix: prefix
   auth:
     method: Token # Token, Kubernetes
     tokenValue: token

Configure a HashiCorp Vault secretStore

The following parameters are required for the configuration of the HashiCorp Vault Secret Store.

When configuring the vault information in the Scope (Environment Settings > Scopes > Scope > Details) make sure you do not include the enginePath in the Path to Key parameter.

Configure an Environment Variable secretStore

The Secret Management Service can also obtain private keys from environment variables, to configure a Secret Store that reads the private keys from environment variables, use the following configuration:

Please note, the table above describes just the fields that are specific to the environment variable secret store configuration, additional, general settings are described above.

Sample configuration

secrets-mgmt:
  enabled: false
  replicaCount: 1
  command: []
  # Allows you to add any config files to /app/config
  plainIDConfig:
    config.yaml:
      server:
        port: 8080
      # Which IP is allowed to make requests to secret-mgmt
        bindIp: 0.0.0.0
      management:
        port: 8081
      log:
        level: "info" #debug,trace
        format: "json"
        logTo: "console" # rolling, file
      rabbitmq:
        enabled: false
      gin:
        mode: release  # debug, release
      # Secret Store configuration
      secretStore:
       - id: ENV_VAR_SECRET
          type: Environment
          isDefault: true
          decoder: Base64
          details:
            name: ENV_VAR_SECRET

Configure a Text File secretStore

The Secret Management Service can also obtain private keys from text files, to configure a secretStore that reads the private keys from text files, use the following configuration:

Please note, the table above describes just the fields that are specific to the environment variable secret store configuration, additional, general settings are described above.

Sample Configuration

server:
 port: ${APP_PORT:8072}
 bindIp: ${IP_BIND:127.0.0.1}
management:
 port: ${MANAGEMENT_PORT:8077}
log:
 level: "debug"
 format: "json"
 logTo: "console"
rabbitmq:
 enabled: false
gin:
 mode: ${GIN_MODE:release}  # debug, release
​
secretStore:
 - id: fileSecret
   type: File
   isDefault: true
   Decoder: Base64
   details:
     path: /app/conf/filename.txt

Scope Level Configuration

In addition to the configuration of the Secret Management Service and the Secret Store in the Policy Authorization Agent, additional settings can be configured in the PlainID Policy Administration Point (PAP).

JWT Signing Settings

This section includes the relevant configuration attributes for obtaining the private key that will be used to sign the PlainID Policy Decision Point JWT

JWT Response Settings