Vault secrets
Read secrets from HashiCorp Vault at run time and expose them to later steps.
About
Read secrets from HashiCorp Vault at run time and expose them to later steps.
This is a placeholder for a step we are considering. It is not in the library yet. Custom steps run today: any container image can be a workflow step, so you can build this yourself now and tell us if you want it maintained.
Use cases
- Keep secrets in Vault; reference them from workflows.
- Short-lived cloud credentials per run.
Inputs
Inputs will be defined with the step. Expect a connection or token (stored as a secret), a target such as a channel or project, and thresholds.
What it creates
How it runs on StackGuardian
Add it to a workflow as a step. It runs in its own container alongside the IaC steps.
Approvals happen in StackGuardian. An agent can never approve its own run. Every run keeps its plan, policy results and approver in the audit log.