Bitbucket Pipeline <> Hashicorp Vault - Support to Access All Vault Paths

[Vinoth Kumar Karuppuchamy]

Hi, We see that there is only kv secret engine support to read static secrets from hashicorp vault. But for our workflow, we are looking to access our application's - role id and secret id from the approle authentication backend. Is there something in the works to integrate bitbucket pipelines with other vault secret backends and auth backends and allow it to read and write from any vault path?

For e.g.

vault read auth/approle/role/test-app/role-id

vault write -wrap-ttl=30m -f auth/approle/role/test-app/secret-id

We cannot utilize most of the functionalities from the hashicorp vault with bitbucket pipelines.

[Patrik S · Accepted solution]

Hello @Vinoth Kumar Karuppuchamy ,

Welcome to Atlassian Community!

I'm assuming you are talking about the pipe atlassian/vault-secrets that can be used to fetch secrets from a HashiCorp vault. According to that pipe's documentation it currently only supports kv secret engine vault type. 

I understand you would like to have access to other types of vault backends that are not currently included in this pipe.

After some research, I found that Hashcorp offers a command-line interface (CLI) that leverages a great part of their API functionalities, and might also offer the feature you are looking for.

You could try installing the Vault's CLI into the docker image you use in your build, and then configure the Vault CLI according to Vault's documentation. For a full list of commands available in Vault's CLI, I would suggest referring to Vault Commands (CLI).

Let me know in case you have any questions.

Thank you, @Vinoth Kumar Karuppuchamy .

Patrik S