TMT.Extensions.Configuration.Vault

Loads ASP.NET Core configuration from HashiCorp Vault (KV secrets engine) through VaultSharp.Extensions.Configuration.

Target frameworks: net6.0, net8.0, net9.0.

Install

dotnet add package TMT.Extensions.Configuration.Vault

The package is hosted on the TMT feed. Add the source to your NuGet.config:

<add key="TMT" value="https://package.public.rke.app.dev.tmtco.org/v3/index.json" />

Usage

using TMT.Extensions.Configuration.Vault;

var builder = WebApplication.CreateBuilder(args);
builder.AddHashiCorpVaultConfiguration();

AddHashiCorpVaultConfiguration adds configuration sources in this order (last wins):

1. appsettings.json and appsettings.{Environment}.json
2. Vault secrets under Vault:BasePath in Vault:MountPath
3. Environment variables

To pass a VaultConfiguration built in code, call builder.AddCustomVaultConfiguration(configuration).

Configuration

The Vault:* keys are read from builder.Configuration, so any source loaded before the call works: appsettings*.json, environment variables (including environmentVariables in launchSettings.json), user secrets or command-line arguments. In environment variables use __ instead of : (Vault__Addr).

A missing required key throws ArgumentNullException at startup.

Local development

Put the non-secret keys in Properties/launchSettings.json:

"environmentVariables": {
  "ASPNETCORE_ENVIRONMENT": "Development",
  "Vault__Addr": "https://vault.example.com",
  "Vault__Role": "my-service",
  "Vault__BasePath": "my-service/local",
  "Vault__MountPath": "kv",
  "Vault__Token": "<token>"  # Only for local development, do not commit this
}

Kubernetes (Helm)

In the cluster the package logs in to Vault with the pod's service account token (Kubernetes auth). Three things must line up: Vault role ↔ service account ↔ Vault__* env vars.

1. Vault — a role bound to the pod's service account, allowed to read <MountPath>/data/<BasePath> (KV v2):

vault write auth/kubernetes/role/my-service-read-role \
  bound_service_account_names=my-service-sa \
  bound_service_account_namespaces=my-namespace \
  policies=my-service-read-policy

2. values.yaml

serviceAccount:
  name: my-service-sa                      # = bound_service_account_names

env:
  Vault__Addr: http://vault.vault.svc:8200 # Currently, in-cluster address (RKR-DEVAPP) with namespace 'vault', and deployment 'vault'. Only use the in-cluster address for Development.
  Vault__Role: my-service-read-role        # = Vault role name
  Vault__MountPath: kv
  Vault__BasePath: my-service/production  # Ex: my-team/env/my-service

3. templates/deployment.yaml — use the service account, keep its token mounted, render the env vars:

spec:
  template:
    spec:
      containers:
          env:
            {{- range $key, $value := .Values.env }}
            - name: {{ $key }}
              value: {{ $value | quote }}
            {{- end }}

Notes:

• Secrets are read once at startup: after changing a secret, restart the pods.

Maintainer

• Name: Nguyễn Tấn Đạt
• Email: datnt@tmtco.asia
• Rocket.Chat: @datnt
• Company: TMTCO.ASIA