Home / server / Questions / 1090820
Accepted
devent
Asked: 2022-01-23 08:47:22 +0800 CST

Vault configuration supports environment variables?

  • 772

Most configs support inline variables from the environment. Does support Vault configuration supports environment variables? Something like:

      ui = true
      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
      }
      storage "postgresql" {
        connection_url = $PG_URL // where PG_URL is an environment variable
      }
vault

3 Answers

  1. Best Answer

    At the moment it is not directly possible. Check this GH issue. But you can use envsubst.

    • 1

  2. Although it is not possible, keep in mind that Vault will read environment variable for many configuration items if they are missing in the file.

    For example, if you don't know the API address the clients should use beforehand, remove it from your configuration file and let Vault discover it through the VAULT_API_ADDR variable.

    Otherwise run your "unresolved" file through envsubst like suggested by Alex like this:

    < vault-unresolved-config.hcl envsubst > vault-config.hcl
    • 0

  3. While it doesn’t directly support variables aside from the built-in environment variables, you can use a HEREDOC to dynamically populate the configuration file prior to execution. This is often necessary even with Terraform (another Hashicorp product) that has wide support for variable with the exception of their Backend configuration details.

    • 0