11---
2- title : HashiCorp Vault
2+ title : Secret Management
33sidebar_position : 7
44---
55
66import Tabs from '@theme/Tabs ';
77import TabItem from '@theme/TabItem ';
88
9- # HashiCorp Vault Setup
9+ # Secret Management Setup
1010
1111## Overview
1212
13- HashiCorp Vault is used for:
13+ Our platform supports two options for secret management:
14+ - HashiCorp Vault
15+ - Google Secret Manager
1416
17+ Both services are used for:
1518- Secrets management
1619- Encryption key storage
1720- Secure credentials handling
@@ -20,7 +23,59 @@ HashiCorp Vault is used for:
2023## Deployment Options
2124
2225<Tabs >
23- <TabItem value =" cloud " label =" HCP Vault (Recommended) " default >
26+ <TabItem value =" gsm " label =" Google Secret Manager " default >
27+
28+ ### Google Secret Manager Setup
29+
30+ 1 . ** Enable the Secret Manager API**
31+ - Go to [ Google Cloud Console] ( https://console.cloud.google.com )
32+ - Navigate to Secret Manager
33+ - Enable the Secret Manager API for your project
34+
35+ 2 . ** Create Service Account**
36+ - Navigate to IAM & Admin > Service Accounts
37+ - Create a new service account
38+ - Grant the following roles:
39+ - ` Secret Manager Admin `
40+
41+ 3 . ** Download Credentials**
42+ - Create and download a JSON key for the service account
43+ - Keep this file secure - you'll need it during platform installation
44+
45+ ::: tip
46+ Google Secret Manager provides:
47+ - Fully managed service
48+ - Automatic replication
49+ - Fine-grained IAM controls
50+ - Audit logging
51+ :::
52+
53+ ** Helm Chart Values:**
54+ ``` yaml
55+ # values.yaml for Helm installation
56+ googleSecretManager :
57+ # -- Enable Google Secret Manager integration
58+ enabled : true
59+ # -- The Google Cloud project ID
60+ projectId : " your-project-id"
61+ # -- The Google Cloud service account credentials JSON
62+ credentials : |
63+ {
64+ // Your service account JSON key
65+ }
66+ ` ` `
67+ :::
68+
69+ :::tip
70+ Make sure to:
71+ 1. Enable Google Secret Manager in your Helm values
72+ 2. Use the same project ID and credentials as in your platform configuration
73+ 3. Properly format the service account JSON credentials
74+ :::
75+
76+ </TabItem>
77+
78+ <TabItem value="hcp" label="HCP Vault" default>
2479
2580### HashiCorp Cloud Platform Setup
2681
@@ -100,7 +155,8 @@ HCP Vault provides:
100155 :: :
101156
102157</TabItem>
103- < TabItem value=" helm" label=" Self-Hosted" >
158+
159+ <TabItem value="self-hosted" label="Self-Hosted Vault">
104160
105161# ## Helm Chart Installation
106162
@@ -146,27 +202,85 @@ For production:
146202
147203# ## Required Values for Platform Installation
148204
205+ Choose one of the following configurations for your Helm values :
206+
207+ **For Google Secret Manager:**
208+ - [ ] GCP Project ID
209+ - [ ] Service Account JSON key
210+
211+ :::note Example Helm Values for GSM
212+ ` ` ` yaml
213+ # values.yaml
214+ vault:
215+ enabled: false
216+
217+ googleSecretManager:
218+ # -- Enable Google Secret Manager integration
219+ enabled: true
220+ # -- The Google Cloud project ID
221+ projectId: 'your-project-id'
222+ # -- The Google Cloud service account credentials JSON
223+ credentials: |
224+ {
225+ // Your service account JSON key
226+ }
227+ ` ` `
228+ :: :
229+
230+ **For HashiCorp Vault:**
149231- [ ] Vault address/endpoint
150232- [ ] Role ID
151233- [ ] Secret ID
152234- [ ] Namespace (if using HCP Vault : ` admin` )
153235
154- :::note Example Configuration
155-
236+ :::note Example Helm Values for Vault
156237` ` ` yaml
238+ # values.yaml
239+ googleSecretManager:
240+ enabled: false
241+
157242vault:
243+ # -- Enable Hashicorp Vault integration
244+ enabled: true
245+ # -- The vault address you collected in the prerequisites
158246 address: 'https://vault-cluster.hashicorp.cloud:8200'
159- namespace: 'admin' # Required for HCP Vault
247+ # -- The vault namespace you collected in the prerequisites
248+ namespace: 'admin' # Required for HCP Vault
249+ # -- The AppRole roleId you collected in the prerequisites
160250 roleId: 'your-role-id'
251+ # -- The AppRole secretId you collected in the prerequisites
161252 secretId: 'your-secret-id'
162253` ` `
254+ :: :
163255
256+ :::important
257+ Make sure to :
258+ 1. Enable only one secret management solution (`vault` or `googleSecretManager`)
259+ 2. Disable the other option by setting `enabled : false`
260+ 3. Provide all required values for your chosen solution
164261:: :
165262
166263</div>
167264
168265# # Validation
169266
267+ Test your secret management configuration :
268+
269+ <Tabs>
270+ <TabItem value="gsm" label="Google Secret Manager">
271+
272+ ` ` ` bash
273+ # Set environment variables
274+ export GOOGLE_APPLICATION_CREDENTIALS="path/to/service-account.json"
275+ export PROJECT_ID="your-project-id"
276+
277+ # Verify access
278+ gcloud secrets list --project=$PROJECT_ID
279+ ` ` `
280+
281+ </TabItem>
282+ <TabItem value="vault" label="HashiCorp Vault">
283+
170284Test your Vault configuration :
171285
172286` ` ` bash
@@ -182,26 +296,28 @@ vault write auth/approle/login \
182296 secret_id=$VAULT_SECRET_ID
183297` ` `
184298
299+ </TabItem>
300+ </Tabs>
301+
185302# # Troubleshooting
186303
187304Common issues and solutions :
188305
189- 1. ** Authentication Failures**
190-
191- - Verify role ID and secret ID
192- - Check policy attachments
193- - Confirm namespace setting
194- - Validate token TTLs
306+ 1. **Google Secret Manager Issues**
307+ - Verify service account permissions
308+ - Check credentials file format
309+ - Confirm API is enabled
310+ - Validate project ID
195311
196- 2. ** Connection Issues**
312+ 2. **Vault Issues**
197313 - Verify Vault address
198314 - Check network access
199315 - Confirm TLS settings
200316 - Validate namespace (HCP)
201317
202318# # Next Steps
203319
204- 1. ✅ Set up Vault instance
320+ 1. ✅ Set up secret management service
2053212. ✅ Configure authentication
2063223. ➡️ Proceed to [Metrics and Logs Setup](/documentation/docs/launch-platform/self-hosted/installation-guide/prerequisites/metrics-and-logs)
207323
0 commit comments