runr_secret_store (Resource)

A secret store of the organization (secret stores): HashiCorp Vault or OpenBao, AWS Secrets Manager, GCP Secret Manager or Azure Key Vault. Secret variables refer to values in it (runr_env_var.reference); External Secrets Operator reads them in the project's region.

A store holds settings only — addresses, mounts, roles — never a credential: it trusts the region cluster's service account issuer and the service account RunR names (kubernetes_name). The data source runr_secret_store_trust gives what to configure on the store's side per region. Changes reach the regions with the next deploy of a project that refers to the store.

Deleting a store is refused while a secret variable refers to it. Needs secret_stores.manage. Import with the store's id or name.

Example Usage#

# A Vault (or OpenBao) store: the region logs in with its service account token (JWT auth at
# the mount runr-eu; data.runr_secret_store_trust gives what that auth method has to trust).
resource "runr_secret_store" "vault" {
  name = "vault-prod"
  type = "vault"
  auth = "jwt"
  settings = {
    server     = "https://vault.example.com:8200"
    role       = "runr"
    auth_mount = "runr-eu"
    mount      = "secret"
    kv_version = "v2"
  }
}

# AWS Secrets Manager through workload identity federation: the role trusts the region's issuer.
resource "runr_secret_store" "aws" {
  name             = "aws-eu"
  type             = "aws"
  refresh_interval = 900
  settings = {
    region   = "eu-central-1"
    role_arn = "arn:aws:iam::123456789012:role/runr-secrets"
  }
}

Schema#

Required#

• name (String) Name, unique in the organization (lower case letters, digits and dashes, at most 63). Can be changed in place.
• settings (Map of String) The provider's settings (by type); all of them (a setting removed here is removed from the store). vault: server and role (required), mount, kv_version (v1 or v2), vault_namespace, ca_bundle (PEM), auth_mount, audience (jwt). aws: region, role_arn (required), audience. gcp: project_id, audience (the workload identity provider; required), service_account_email. azure: vault_url (https), tenant_id, client_id (required). Any other key is refused — RunR takes no credential.
• type (String) The store's provider (the API's provider): vault (HashiCorp Vault or OpenBao), aws (Secrets Manager), gcp (Secret Manager) or azure (Key Vault). Changing it creates a new store.

Optional#

• auth (String) How the store authenticates the region: kubernetes (default) or jwt for vault, workload_identity for the clouds. Left out, the store keeps its current one.
• refresh_interval (Number) Seconds between syncs of the values (60–86400). Left out: a new store syncs at the installation's interval (default 3600), an existing one keeps its interval.

Read-Only#

• audience (String) Audience of the service account tokens the store logs in with (null for Vault's Kubernetes auth).
• id (String) Store id.
• kubernetes_name (String) Name of the store's SecretStore and service account in a region's project namespace.
• references (Number) Number of secret variables that refer to the store.
• regions (Attributes Map) The store's state per region id, as the last verification found it. (see below for nested schema)

Nested Schema for regions#

Read-Only:

• checked_at (String) When it was checked.
• message (String) Why, when not ready.
• status (String) ready, failed or pending.

Import#

Import is supported using the following syntax:

The terraform import command can be used, for example:

# <store id or name>
terraform import runr_secret_store.vault vault-prod