Vault usage explanation

Description

I am trying to use Vault to read secrets from. I have a chart yaml file that looks like this

  Master:
    ContainerEnv:
      - name: CASC_VAULT_TOKEN
        value: "some-auth-token"
      - name: CASC_VAULT_URL
        value: "http://10.180.0.1:8200"
      - name: CASC_VAULT_PATHS
        value: "database/creds/pgsql_role"

I generated the CASC_VAULT_TOKEN with vault token create -policy=token-policy -use-limit=10, and that policy has read access to the database/creds/pgsql_role path. My problem is how to read the secrets from vault after spinning up Jenkins. Do I use certain env variables? Basically I want Jenkins to do vault read database/creds/pgsql_role and use the username and password generated. It seems the documentation is talking about using Docker secrets but does not give specific examples. Any help would be appreciated.

[dhs-rec]

I wonder why this ticket has been closed w/o improving the documentation (as requested). I also needed to find this ticket to really understand how things work. Please reopen and improve the docs.

[alan-mas]

Hi all! I just found this thread and it has been pretty helpfull for me, but I do still do not find a solution of my issue (in case adding a comment in a close issue is wrong, please feel free to delete my comment @jetersen).

CONTEXT: I am triying to deploy a Jenkins using helm with JCASC to get vault secrets. I am using a local minikube to create mi k8 cluster and a local vault instance in my machine (not in k8 cluster).

Even that I am trying using initContainerEnv and ContainerEnv I am not able to reach the vault values. For CASC_VAULT_TOKEN value I am using vault root token. This is helm command i run locally:

helm upgrade --install -f values.yml mijenkins jenkins/jenkins

And here is my values.yml file code:

controller:
  installPlugins:
    # need to add this configuration-as-code due to a known jenkins issue: https://github.com/jenkinsci/helm-charts/issues/595
  - "configuration-as-code:1414.v878271fc496f"
  - "hashicorp-vault-plugin:latest"

  # passing initial environments values to docker basic container
  initContainerEnv:
  - name: CASC_VAULT_TOKEN
    value: "my-vault-root-token"
  - name: CASC_VAULT_URL
    value: "http://localhost:8200"
  - name: CASC_VAULT_PATHS
    value: "cubbyhole/jenkins"
  - name: CASC_VAULT_ENGINE_VERSION
    value: "2"
  ContainerEnv:
  - name: CASC_VAULT_TOKEN
    value: "my-vault-root-token"
  - name: CASC_VAULT_URL
    value: "http://localhost:8200"
  - name: CASC_VAULT_PATHS
    value: "cubbyhole/jenkins"
  - name: CASC_VAULT_ENGINE_VERSION
    value: "2"

  JCasC:
    configScripts:
      here-is-the-user-security: |
        jenkins:
          securityRealm:
            local:
              allowsSignup: false
              enableCaptcha: false
              users:
                - id: "${JENKINS_ADMIN_ID}"
                  password: "${JENKINS_ADMIN_PASSWORD}"

And in my local vault I can see/reach values:

>vault kv get cubbyhole/jenkins
============= Data =============
Key                       Value
---                       -----
JENKINS_ADMIN_ID          alan
JENKINS_ADMIN_PASSWORD    acosta

Any of you have an idea what I could be doing wrong?