openshift-secrets-vault¶

Back OpenShift cluster secrets with HashiCorp Vault via LookupUri references

Backs a cluster's secrets with a HashiCorp Vault instance through the DRP vault secret-store plugin. Nests the openshift-secrets base profile (which defines the references) and supplies the Vault URI grammar:

• per-cluster prefix: <store>://value?path=<name>.<cluster-domain>/
• pull secret: <store>://value?path=openshift/pull-secret&format=json

where <store> is the plugin instance named by openshift/secrets/store. The profile also carries openshift/secrets/type: vault (the plugin provider name) so content that must branch or validate per backend can read it instead of guessing from the reference shape; operators never set it by hand.

Usage¶

1. Install the vault plugin content and configure a vault plugin instance; record its name.
2. Set openshift/secrets/store to that instance name.
3. Ensure openshift/cluster-domain is set for the cluster.
4. Apply this profile to the cluster.

See the openshift-secrets profile for how references resolve, the scope of covered params, write-through behavior, and the shared-profile RBAC caveat.

Objects that Reference openshift-secrets-vault¶

Not used in current content packs

Objects used by openshift-secrets-vault¶

• params openshift/secrets/pull-secret-uri in field Params as value {{.ParamExpand "openshift/secrets/store"}}://value?path=openshift/pull-secret&format=json
• params openshift/secrets/type in field Params as value vault
• params openshift/secrets/uri-prefix in field Params as value {{.ParamExpand "openshift/secrets/store"}}://value?path={{.Machine.Name}}.{{.ParamExpand "openshift/cluster-domain"}}/
• profiles openshift-secrets in field Profiles as value openshift-secrets
• params openshift/secrets/store
• params openshift/secrets/store
• params openshift/cluster-domain