Alex Harness
79283d93ac
A slight update for clarity regarding the wording of the Note regarding the recommendation of using the 'VAULT_TOKEN' environment variable as opposed to using the token parameter in the configuration file.
113 lines
4.1 KiB
Plaintext
113 lines
4.1 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Vault Transit - Seals - Configuration
|
|
sidebar_title: Vault Transit
|
|
description: |-
|
|
The Transit configures Boundary to use Vault's Transit Secret Engine for key management.
|
|
---
|
|
|
|
# `transit` Seal
|
|
|
|
The Transit configures Boundary to use Vault's Transit Secret Engine for key management.
|
|
|
|
The Transit KMS is activated by the presence of a `kms "transit"` block in Boundary's configuration file
|
|
|
|
## `transit` Example
|
|
|
|
This example shows configuring Transit KMS through the Boundary configuration file
|
|
by providing all the required values:
|
|
|
|
```hcl
|
|
kms "transit" {
|
|
purpose = "root"
|
|
address = "https://vault:8200"
|
|
token = "s.Qf1s5zigZ4OX6akYjQXJC1jY"
|
|
disable_renewal = "false"
|
|
|
|
// Key configuration
|
|
key_name = "transit_key_name"
|
|
mount_path = "transit/"
|
|
namespace = "ns1/"
|
|
|
|
// TLS Configuration
|
|
tls_ca_cert = "/etc/vault/ca_cert.pem"
|
|
tls_client_cert = "/etc/vault/client_cert.pem"
|
|
tls_client_key = "/etc/vault/ca_cert.pem"
|
|
tls_server_name = "vault"
|
|
tls_skip_verify = "false"
|
|
}
|
|
```
|
|
|
|
## `transit` Parameters
|
|
|
|
These parameters apply to the `kms` stanza in the Vault configuration file:
|
|
|
|
- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `root`,
|
|
`recovery`, or `config`.
|
|
|
|
- `address` `(string: <required>)`: The full address to the Vault cluster.
|
|
This may also be specified by the `VAULT_ADDR` environment variable.
|
|
|
|
- `token` `(string: <required>)`: The Vault token to use. This may also be
|
|
specified by the `VAULT_TOKEN` environment variable.
|
|
|
|
- `key_name` `(string: <required>)`: The transit key to use for encryption and
|
|
decryption. This may also be supplied using the `TRANSIT_WRAPPER_KEY_NAME`
|
|
environment variable.
|
|
|
|
- `mount_path` `(string: <required>)`: The mount path to the transit secret engine.
|
|
This may also be supplied using the `TRANSIT_WRAPPER_MOUNT_PATH` environment
|
|
variable.
|
|
|
|
- `namespace` `(string: "")`: The namespace path to the transit secret engine.
|
|
This may also be supplied using the `VAULT_NAMESPACE` environment variable.
|
|
|
|
- `disable_renewal` `(string: "false")`: Disables the automatic renewal of the token
|
|
in case the lifecycle of the token is managed with some other mechanism outside of
|
|
Vault, such as Vault Agent. This may also be specified using the
|
|
`TRANSIT_WRAPPER_DISABLE_RENEWAL` environment variable.
|
|
|
|
- `tls_ca_cert` `(string: "")`: Specifies the path to the CA certificate file used
|
|
for communication with the Vault server. This may also be specified using the
|
|
`VAULT_CA_CERT` environment variable.
|
|
|
|
- `tls_client_cert` `(string: "")`: Specifies the path to the client certificate
|
|
for communication with the Vault server. This may also be specified using the
|
|
`VAULT_CLIENT_CERT` environment variable.
|
|
|
|
- `tls_client_key` `(string: "")`: Specifies the path to the private key for
|
|
communication with the Vault server. This may also be specified using the
|
|
`VAULT_CLIENT_KEY` environment variable.
|
|
|
|
- `tls_server_name` `(string: "")`: Name to use as the SNI host when connecting
|
|
to the Vault server via TLS. This may also be specified via the
|
|
`VAULT_TLS_SERVER_NAME` environment variable.
|
|
|
|
- `tls_skip_verify` `(bool: "false")`: Disable verification of TLS certificates.
|
|
Using this option is highly discouraged and decreases the security of data
|
|
transmissions to and from the Vault server. This may also be specified using the
|
|
`VAULT_SKIP_VERIFY` environment variable.
|
|
|
|
## Authentication
|
|
|
|
Authentication-related values must be provided, either as environment
|
|
variables or as configuration parameters.
|
|
|
|
~> **Note:** Although the configuration file allows you to pass in
|
|
`token` as part of the KMS stanza's parameters, it is _strongly_ recommended
|
|
to omit the `token` parameter from the configuration file and set the
|
|
token used to authenticate to Vault via the `VAULT_TOKEN` environment variable.
|
|
|
|
The Vault token used to authenticate needs the following permissions on the
|
|
transit key:
|
|
|
|
```hcl
|
|
path "<mount path>/encrypt/<key name>" {
|
|
capabilities = ["update"]
|
|
}
|
|
|
|
path "<mount path>/decrypt/<key name>" {
|
|
capabilities = ["update"]
|
|
}
|
|
```
|