anax icon indicating copy to clipboard operation
anax copied to clipboard

Feature Request: allow HashiCorp Vault connection and configuration parameters to be configurable

Open t-fine opened this issue 10 months ago • 0 comments

Is your feature request related to a problem? Please describe.

Due to the limited configurability of the secrets manager parameters I am unable to use the desired external Hashicorp vault I have provisioned. IBM Secrets Manager does not allow users to modify the default plugin path auth/ibmcloud and the agbot similarly does not allow me to modify the default plugin path of auth/openhorizon making it impossible for the agbot to login to the secrets manager. Additionally, the agbot attempts to initially log into the external secrets manager instance using the values stored in Exchange ID and Exchange token. If those are populated as-is, the agbot cannot log into the SM instance, and if they are modified, the agbot cannot contact the exchange.

Describe the solution you'd like.

I would like the v1/auth/openhorizon/login path to be configurable, at least the openhorizon bit, so it could be substituted with ibmcloud if needed. Also, added configuration values in the Vault config options to allow a user to set the vault token used to login to the SM without interfering with the exchange token value, or perhaps not relying on the exchange token value to login to the SM instance at all if a vault token is provided. Within the agbot config is a vault config that could perhaps be expanded to include a plugin path name, and a token

https://github.com/open-horizon/anax/blob/6c8119452e7acd7f5b1cec4da1a96a3969e9cbdf/config/config.go#L139

Describe alternatives you've considered

No response

Additional context.

No response

t-fine avatar Apr 22 '24 21:04 t-fine