sisl-uic/HashiCorp Vault
A Github Action that allows you to consume HashiCorp Vault™ secrets as secure environment variables
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| url | The URL for the vault endpoint | yes | — |
| secrets | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details | no | — |
| pki | A semicolon-separated list of certificates to generate. These will automatically be converted to environment variable keys. Cannot be used with "secrets". See README for more details | no | — |
| namespace | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default | no | — |
| method | The method to use to authenticate with Vault. | no | token |
| role | Vault role for specified auth method | no | — |
| path | The Vault path for the auth method. | no | — |
| token | The Vault token to be used to authenticate with Vault | no | — |
| roleId | The role ID for App Role authentication | no | — |
| secretId | The secret ID for App Role authentication | no | — |
| githubToken | The Github Token to be used to authenticate with Vault | no | — |
| kubernetesTokenPath | The path to the Kubernetes service account secret | no | /var/run/secrets/kubernetes.io/serviceaccount/token |
| username | The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | no | — |
| password | The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | no | — |
| authPayload | The JSON payload to be sent to Vault when using a custom authentication method. | no | — |
| extraHeaders | A string of newline separated extra headers to include on every request. | no | — |
| exportEnv | Whether or not export secrets as environment variables. | no | true |
| exportToken | Whether or not export Vault token as environment variables. | no | false |
| outputToken | Whether or not to set the `vault_token` output to contain the Vault token after authentication. | no | false |
| caCertificate | Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla. | no | — |
| clientCertificate | Base64 encoded client certificate for mTLS communication with the Vault server. | no | — |
| clientKey | Base64 encoded client key for mTLS communication with the Vault server. | no | — |
| tlsSkipVerify | When set to true, disables verification of the Vault server certificate. Setting this to true in production is not recommended. | no | false |
| jwtPrivateKey | Base64 encoded Private key to sign JWT | no | — |
| jwtKeyPassword | Password for key stored in jwtPrivateKey (if needed) | no | — |
| jwtGithubAudience | Identifies the recipient ("aud" claim) that the JWT is intended for | no | — |
| jwtTtl | Time in seconds, after which token expires | no | 3600 |
| secretEncodingType | The encoding type of the secret to decode. If not specified, the secret will not be decoded. Supported values: base64, hex, utf8 | no | — |
| ignoreNotFound | Whether or not the action should exit successfully if some requested secrets were not found. | no | false |
Outputs
no outputs