Integration with HashiCorp Vault | Feature Requests

Integration with HashiCorp Vault

under review

Sean Carolan

Vault supports features like dynamic secrets generation, where you could create AWS keys that were only good for a limited time. Instead of long-lived creds stored as environment variables, you can update them every day, or every CI/CD run.

CCI-I-1069

June 12, 2019

Nathan Fish

There are two options here that we are considering. Interested in hearing opinions on which is preferred and why.

Integration with contexts where the secret in vault (or other secrets management engines) is input as a path in the value field. This works well for updating existing secrets without having to update config files for projects. It also means restrictions like group, project, and expressions continue to work.
Config.yaml only configuration, where the config includes the connection details to the external secret store as well as mapping details of the secrets key and value. This allows the key values to be masked. This would require customers to update their config files.

Nathan Fish

marked this post as

under review

Opening this idea back up for further review. Including the needs to mask secrets.

Nathan Fish

Merged in a post:

Ability To Mask Secrets From An External Source

Nick Smith

It would be helpful if secrets from an external source, like Vault, could be masked in the same way that env vars are.

October 9, 2024

Nathan Fish

Merged in a post:

Integration for Hashicorp Vault

Oran Wilder

Create and manage connections to Hashicorp Vault at the organization level. Org admins can configure Vault paths and map secrets to CircleCI environment variables for secure pipelines without the toil of editing config.

October 9, 2024

Oran Wilder

Vote on this topic to get notified when this feature is available.

Nathan Fish

marked this post as

complete

Nathan Fish

We have chosen to support OIDC given you the ability to securely integrate with Hashicorp vault via assuming role with identity. More about OIDC support here https://circleci.com/docs/2.0/openid-connect-tokens/ and vaults documentation here https://learn.hashicorp.com/tutorials/vault/oidc-auth.

Eric Jones

This would be great coupled with private HashiCorp Vault backend integration.

Iiro Niinikoski

This would be brilliant.