HashiCorp Vault Secrets Manager
How to store secrets in HashiCorp Vault
The HashiCorp Vault secrets manager is a secrets manager flavor provided with the ZenML
vaultintegration that uses HashiCorp Vault to store secrets.
We are deprecating secrets managers in favor of the centralized ZenML secrets store. Going forward, we recommend using the secrets store instead of secrets managers to configure and store secrets.
If you already use secrets managers to manage your secrets, please use the provided
zenml secrets-manager secrets migrateCLI command to migrate your secrets to the centralized secrets store.
To continue using HashiCorp Vault as the service of choice for managing your secrets in the cloud, configure your ZenML server to connect to and use the HashiCorp Vault service directly as a back-end for the centralized secrets store and then use
zenml secretCLI commands to manage your secrets instead of
zenml secrets-manager secretCLI commands. You no longer need to register the HashiCorp Vault secrets manager or add it to your active stack.
Alternatively, you may use any of the other secrets store back-ends that the ZenML server supports, such as Google Secret Manager, Azure Key Vault, AWS Secrets Manager, or even the ZenML SQL database.
You should use the HashiCorp Vault secrets manager if:
- a component of your stack requires a secret for authentication, or you want to use secrets inside your steps.
- you're already using HashiCorp Vault to store your secrets or want a self-hosted secrets solution.
To get started with this secrets manager, you need to either:
Once you decided and finished setting up one of the two solutions, you need to enable the KV Secrets Engine - Version 2.
To use the Vault secrets manager, we need:
- The ZenML
vaultintegration installed. If you haven't done so, runzenml integration install vault
- The Vault server URL and KV Secrets Engine v2 endpoint.
We can then register the secrets manager and use it in our active stack:
zenml secrets-manager register <NAME> \
# Add the secrets manager to the active stack
zenml stack update -x <NAME>
You can now register, update or delete secrets using the CLI or fetch secret values inside your steps.
You can use secret scoping with the Vault Secrets Manager to manage multiple Secrets Manager namespaces on top of a single Vault service instance.
For more information and a full list of configurable attributes of the HashiCorp Vault secrets manager, check out the API Docs.