Skip to content

vault-jwt

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History
 
 

vault-jwt

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
main.test.ts
main.test.ts
 
 
main.tf
main.tf
 
 
run.sh
run.sh
 
 

README.md

display_name Hashicorp Vault Integration (JWT)
description Authenticates with Vault using a JWT from Coder's OIDC provider
icon ../.icons/vault.svg
maintainer_github coder
partner_github hashicorp
verified true
tags
helper
integration
vault
jwt
oidc

Hashicorp Vault Integration (JWT)

This module lets you authenticate with Hashicorp Vault in your Coder workspaces by reusing the OIDC access token from Coder's OIDC authentication method. This requires configuring the Vault JWT/OIDC auth method.

module "vault" {
  count          = data.coder_workspace.me.start_count
  source         = "registry.coder.com/modules/vault-jwt/coder"
  version        = "1.0.20"
  agent_id       = coder_agent.example.id
  vault_addr     = "https://vault.example.com"
  vault_jwt_role = "coder" # The Vault role to use for authentication
}

Then you can use the Vault CLI in your workspaces to fetch secrets from Vault:

vault kv get -namespace=coder -mount=secrets coder

or using the Vault API:

curl -H "X-Vault-Token: ${VAULT_TOKEN}" -X GET "${VAULT_ADDR}/v1/coder/secrets/data/coder"

Examples

Configure Vault integration with a non standard auth path (default is "jwt")

module "vault" {
  count               = data.coder_workspace.me.start_count
  source              = "registry.coder.com/modules/vault-jwt/coder"
  version             = "1.0.20"
  agent_id            = coder_agent.example.id
  vault_addr          = "https://vault.example.com"
  vault_jwt_auth_path = "oidc"
  vault_jwt_role      = "coder" # The Vault role to use for authentication
}

Map workspace owner's group to a Vault role

data "coder_workspace_owner" "me" {}

module "vault" {
  count          = data.coder_workspace.me.start_count
  source         = "registry.coder.com/modules/vault-jwt/coder"
  version        = "1.0.20"
  agent_id       = coder_agent.example.id
  vault_addr     = "https://vault.example.com"
  vault_jwt_role = data.coder_workspace_owner.me.groups[0]
}

Install a specific version of the Vault CLI

module "vault" {
  count             = data.coder_workspace.me.start_count
  source            = "registry.coder.com/modules/vault-jwt/coder"
  version           = "1.0.20"
  agent_id          = coder_agent.example.id
  vault_addr        = "https://vault.example.com"
  vault_jwt_role    = "coder" # The Vault role to use for authentication
  vault_cli_version = "1.17.5"
}