Configure Device Secrets Via Vault Provider
Integration with a vault provider to inject secrets into the container environment can be used to avoid storing secrets on disk.
Implementation specifics will vary, but at a high level:
- Device credentials are stored in the vault.
- A vault agent (or script, or similar) running on the AST host reads the keys from the vault and injects them into the environment directly, or into file on a ramdisk.
- The configuration files for AST point devices at the appropriate environment variables through the same mechanism as the static file based approach (e.g. ${env:BIGIP_PASSWORD_1}).
For more, see e.g.:
- Hashicorp Vault Agent - secrets as environment variables
- GCP Secret Manager
- Azure Key Vault
- AWS Secret Manager
An extremely simplified example might look like:
$ sudo mkdir /mnt/secrets
$ sudo mount -o size=10M -t tmpfs none /mnt/secrets
$ echo -n "password1_value" | gcloud secrets create BIGIP_PASSWORD_1 --replication-policy="automatic" --data-file=-
$ echo -n "password2_value" | gcloud secrets create BIGIP_PASSWORD_2 --replication-policy="automatic" --data-file=-
$ ./secretfetcher.sh
Secrets have been written to /mnt/secrets/.env.device-secrets
$ cat /mnt/secrets/.env.device-secrets
BIGIP_PASSWORD_1=password1_value
BIGIP_PASSWORD_2=password2_value
And the shell script might look like:
#!/usr/bin/env bash
# List of secret names
secret_names=("BIGIP_PASSWORD_1" "BIGIP_PASSWORD_2")
# Output file
output_file="/mnt/secrets/.env.device-secrets"
# Clear the output file if it already exists
> "$output_file"
for secret in "${secret_names[@]}"; do
# Access the secret value
secret_value=$(gcloud secrets versions access 1 --secret="$secret" 2>/dev/null)
# Check if the secret value was retrieved successfully
if [[ $? -eq 0 ]]; then
# Output in .env style format
echo "$secret=$secret_value" >> "$output_file"
else
echo "Failed to access secret: $secret"
fi
done
echo "Secrets have been written to $output_file"
You’d also need to point to the tmpfs secret file in the docker-compose.yaml
file:
otel-collector:
#...
env_file:
- ".env"
- "/mnt/secrets/.env.device-secrets"