jquepi/Vault Secrets
A Github Action that allows you to consume HashiCorp Vault™ secrets as secure environment variables
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
- Runtime
- Deprecated runtime
Inputs
| name | description | required | default |
|---|---|---|---|
| url | The URL for the vault endpoint | yes | — |
| secrets | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details | no | — |
| namespace | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default | no | — |
| method | The method to use to authenticate with Vault. | no | token |
| role | Vault role for specified auth method | no | — |
| path | Custom Vault path, if the auth method was mounted at a different path | no | — |
| token | The Vault Token to be used to authenticate with Vault | no | — |
| roleId | The Role Id for App Role authentication | no | — |
| secretId | The Secret Id for App Role authentication | no | — |
| githubToken | The Github Token to be used to authenticate with Vault | no | — |
| kubernetesTokenPath | The path to the Kubernetes service account secret | no | /var/run/secrets/kubernetes.io/serviceaccount/token |
| authPayload | The JSON payload to be sent to Vault when using a custom authentication method. | no | — |
| extraHeaders | A string of newline separated extra headers to include on every request. | no | — |
| exportEnv | Whether or not export secrets as environment variables. | no | true |
| exportToken | Whether or not export Vault token as environment variables. | no | false |
| caCertificate | Base64 encoded CA certificate to verify the Vault server certificate. | no | — |
| clientCertificate | Base64 encoded client certificate for mTLS communication with the Vault server. | no | — |
| clientKey | Base64 encoded client key for mTLS communication with the Vault server. | no | — |
| tlsSkipVerify | When set to true, disables verification of the Vault server certificate. Setting this to true in production is not recommended. | no | false |
| jwtPrivateKey | Base64 encoded Private key to sign JWT | no | — |
| jwtKeyPassword | Password for key stored in jwtPrivateKey (if needed) | no | — |
| jwtGithubAudience | Identifies the recipient ("aud" claim) that the JWT is intended for | no | — |
| jwtTtl | Time in seconds, after which token expires | no | 3600 |
Outputs
no outputs