Secret Management

The Secret Management Service acts as a centralized component responsible for securely retrieving and serving Secrets to other PlainID components. By default, this service is not included in the Policy Authorization Agent (PAA) deployment and must be explicitly enabled and configured.

This guide walks you through enabling the Secret Management Service within your PAA deployment by modifying the values-custom.yaml file. You will learn how to activate the service, configure core parameters such as ports and logging, and define one or more Secret Stores that the service will use to fetch Secrets like private keys, tokens, and credentials.

Proper configuration of the Secret Management Service ensures secure, seamless access to sensitive data while enabling advanced features like secret rotation and multi-store management. The example and settings below illustrate typical configuration options and serve as a foundation to tailor the service to your environment’s needs.

Currently, the service supports these use cases:

• Passwords/secrets for data source connections in the PIP-Operator
• Passwords for the PDP Authorization Audit Database connection settings
• REDIS authentication passwords for PAA services
• A private key for the PDP to sign Authorization Decisions returned as JWTs

The Secret Management Service can also be configured through the UI. For more information, refer to About Secret Stores.

Supported Secret Stores

Refer to the following documentation for more information:

• Deployment and Installation

  • Stores
    • Hashicorp
    • AWS Secret Manager
    • AWS RDS IAM Authentication
    • Azure Key Vault
    • Environment Variables
  • Use-cases and Examples
    • AWS ElastiCache Redis Authentication
    • Defining RDS Secrets Using the AWS RDS IAM Authetication Store
    • Using Secrets for PIP Data Source Connections
    • PDP JWT Signing

Configuring the Secret Management Service

By default, the Secret Management Service is not included in the PAA deployment. To enable it, add a secretsMgmt section to the values-custom.yaml file and follow the configuration instructions.

Enabling and Configuring the Service

After adding to the values-custom.yaml file the secret-mgmt section, set it as enabled: true and define additional configuration parameters, such as ports, logging, and most importantly, secretStore definitions.

To use managed stores defined in the Platform in the PAA Store Manager, ensure that that the redisIntegration is set to enabled: true.

Example:

secretsMgmt:
  enabled: true
  ## Enable Redis integration to use cloud secret stores
  redisIntegration:
    enabled: false ## set to true if using managed stores
  replicaCount: 1
  command: []
  # Allows you to add any config files to /app/config
  plainIDConfig:
    config.yaml:
      server:
        port: 8080
        # Which IP is allowed to make requests to secret-mgmt
        bindIp: 0.0.0.0
      management:
        port: 8081
      log:
        level: "info" #debug,trace
        format: "json"
        logTo: "console" # rolling, file
      rabbitmq:
        enabled: false
      gin:
        mode: release # debug, release
      # Secret Store configuration
      secretStore:
        - id: fileSecret
          type: File
          isDefault: true
          decoder: Base64
          details:
            path: /app/config/filename.txt
        # Examples below for HashiCorp Vault based Secret Store
#       - id: vault
#         type: Vault
#         isDefault: true
#         decoder: None # Base64, None
#         details:
#           PathPrefix: prefix
#           defaultPath: vault_
#           skipVerify: true
#           url: vault
#           timeout: 3s
#           enginePath: custom
#
# Authentication method should use a Token
#         auth:
#           method: Token # Token, Kubernetes
#           tokenValue: token
#           tokenFileName: ${ VAULT_TOKEN }  - instead of token value
#
# OR Authentication method should use vault Kubernetes authentication
#         auth:
#           method: Kubernetes
#           path: /var/path-to-file/file.txt
#           role: secrets-mgmt

# Examples below for Environment Variables based on the Secret Store
#       - id: ENV_VAR_SECRET
#          type: Environment
#          isDefault: false
#          decoder: Base64
#          details:
#            name: ENV_VAR_SECRET

Optional Settings for the Secret Management Service

The Environment Variable Store allows secrets to be retrieved from environment variables—commonly used for simpler, local, or container-based deployments. This store is often used for private keys or credentials that are injected at runtime via deployment configurations or Kubernetes manifests.

Environment Variable Secret Store-specific Parameters

To configure a Secret Store that reads private keys from Environment Variables, use the following configuration:

Example

The following example is based on the general store and store-specific parameters.

secretsMgmt:
  ...
  plainIDConfig:
    ...
      # Secret Store configuration
      secretStore:
       - id: ENV_VAR_SECRET
          type: Environment
          isDefault: true
          decoder: Base64
          details:
            name: ENV_VAR_SECRET

Error Logging for External Secret Providers

Errors from external secret providers are now logged in a consistent structure. This standardization improves troubleshooting and observability by making it easier to collect, filter, and monitor provider-related issues.

Format

ERROR "secret provider error from {store type} - {error context}: {provider inner error}"

Log Components

Example

log.Errorf("secret provider error from Vault - unable to connect to vault: %s", clientErr)