1

Most configs support inline variables from the environment. Does support Vault configuration supports environment variables? Something like:

      ui = true
      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
      }
      storage "postgresql" {
        connection_url = $PG_URL // where PG_URL is an environment variable
      }
devent
  • 13
  • 2

3 Answers3

1

At the moment it is not directly possible. Check this GH issue. But you can use envsubst.

AlexD
  • 8,179
  • 2
  • 28
  • 38
  • Thank you, so it's not possible currently (except somehow with Consul, but I don't want to use it) – devent Jan 22 '22 at 19:51
0

Although it is not possible, keep in mind that Vault will read environment variable for many configuration items if they are missing in the file.

For example, if you don't know the API address the clients should use beforehand, remove it from your configuration file and let Vault discover it through the VAULT_API_ADDR variable.

Otherwise run your "unresolved" file through envsubst like suggested by Alex like this:

< vault-unresolved-config.hcl envsubst > vault-config.hcl
ixe013
  • 928
  • 2
  • 7
  • 25
0

While it doesn’t directly support variables aside from the built-in environment variables, you can use a HEREDOC to dynamically populate the configuration file prior to execution. This is often necessary even with Terraform (another Hashicorp product) that has wide support for variable with the exception of their Backend configuration details.

Dustin
  • 1