Configuring Azure Key Vault as a secretstore

Configure Azure Key Vault as secretstore using Service Principal authentication in Automation Suite on OpenShift.

You can configure Azure Key Vault as a secretstore using the Service Principal authentication method.

By default, all sensitive data is defined in input.json. You can separate this data into two parts:

• input.json - contains only configuration data.
• Azure Key Vault - stores credentials securely.

Note:

You cannot store certificate paths or certificate-related credentials as part of the secretstore.

Important:

All credentials referenced in input.json must exist as secrets in the Azure Key Vault before you configure the secretstore. If any referenced credential is missing from Azure Key Vault, the installation fails.

Using Service Principal authentication

To configure Azure Key Vault as secretstore using Service Principal authentication, take the following steps:.

1. For uipathctl to identify that the credentials are stored in the Azure Key Vault, you must add the secretstore section to input.json , as shown in the following example:

   "secret_store": {
     "enabled": true,
     "provider_configs": [
       {
         "type": "azure",
         "credentials_secret_name": "azure-service-principal-secret",
         "refresh_interval": "5m",
         "name": "azure-secret-store",
         "azure_kv": {
           "vault_url": "https://eso-azure-kv.vault.azure.net/",
           "tenant_id": "00000000-0000-0000-0000-000000000000"
         }
       }
     ]
   }
   

2. Create a Kubernetes secret that stores the Azure Service Principal credentials, as shown in the following example:

   apiVersion: v1
   kind: Secret
   metadata:
     name: azure-service-principal-secret
   type: Opaque
   stringData:
     clientId: <client-id>
     clientSecret: <client-secret>
   

3. Deploy the secret in the uipath namespace using the following command:

   kubectl apply -f azure-service-principal-secret -n uipath
   

4. Update the credential values in input.json to reference secrets stored in Azure Key Vault using the following format:

   vault/<vault-name>/<key-stored-in-the-vault>
   

   Where:

   • vault - static keyword.
   • vault-name - the value of secret_store.provider_configs[i].name (for example, azure-secret-store).
   • key-stored-in-the-vault - the name of the secret as stored in Azure Key Vault.Before the change, your credentials might look like this:

   "admin_username": "admin",
   "admin_password": "password",
   

   After updating them to reference Azure Key Vault, they should look like this:

   "admin_username": "vault/azure-secret-store/admin-username-1234",
   "admin_password": "vault/azure-secret-store/admin-password-1234",
   

The following image shows the secrets stored in Azure Key Vault.

The following sample displays an input.json configuration with credentials stored in Azure Key Vault.

{
  "action_center": {
    "enabled": true
  },
  "admin_password": "vault/azure-secret-store/admin-password-1234",
  "admin_username": "vault/azure-secret-store/admin-username-1234",
  "aicenter": {
    "enabled": true
  },
  "apps": {
    "enabled": true
  },
  "argocd": {
    "application_namespace": "uipath",
    "project": "uipath"
  },
  "automation_hub": {
    "enabled": true
  },
  "automation_ops": {
    "enabled": true
  },
  "dataservice": {
    "enabled": true
  },
  "documentunderstanding": {
    "enabled": true
  },
  "exclude_components": [
    "argocd",
    "monitoring",
    "istio",
    "logging",
    "gatekeeper",
    "network-policies",
    "velero",
    "alerts",
    "cert-manager",
    "dapr",
    "external-secrets"
  ],
  "external_object_storage": {
    "access_key": "vault/azure-secret-store/external-object-storage-access-key-1234",
    "enabled": true,
    "fqdn": "s3storage.mycompany.com",
    "port": 443,
    "region": "us-east-2",
    "secret_key": "vault/azure-secret-store/external-object-storage-secret-key-1234",
    "storage_type": "s3"
  },
  "fabric": {
    "redis": {
      "hostname": "redis.mycompany.com",
      "password": "vault/azure-secret-store/fabric-redis-password-1234",
      "port": 6380,
      "tls": true
    }
  },
  "fqdn": "automationsuite.mycompany.com",
  "ingress": {
    "gateway_selector": {
      "istio": "ingressgateway"
    },
    "ingress_gateway_secret": "istio-ingressgateway-certs",
    "namespace": "\u003cistio-system\u003e"
  },
  "insights": {
    "enabled": true
  },
  "istioMinProtocolVersion": "TLSV1_3",
  "kubernetes_distribution": "openshift",
  "namespace": "uipath",
  "orchestrator": {
    "enabled": true
  },
  "platform": {
    "enabled": true
  },
  "postgresql_connection_string_template_sqlalchemy_pyodbc": "vault/azure-secret-store/postgresql-connection-string-template-sqlalchemy-pyodbc-1234",
  "processmining": {
    "enabled": true
  },
  "profile": "default",
  "registries": {
    "docker": {
      "password": "",
      "pull_secret_name": "registry-credentials",
      "pull_secret_value": "",
      "url": "registry.mycompany.com",
      "username": ""
    },
    "helm": {
      "password": "",
      "url": "registry.mycompany.com",
      "username": ""
    }
  },
  "secret_store": {
    "enabled": true,
    "secret_name": "",
    "provider_configs": [
      {
        "type": "azure",
        "credentials_secret_name": "azure-service-principal-secret",
        "refresh_interval": "5m",
        "name": "azure-secret-store",
        "azure_kv": {
          "vault_url": "https://eso-azure-kv.vault.azure.net/",
          "tenant_id": "00000000-0000-0000-0000-000000000000"
        }
      }
    ]
  },
  "sql": {
    "create_db": true,
    "password": "vault/azure-secret-store/sql-password-1234",
    "port": "1433",
    "server_url": "sql.mycompany.com",
    "username": "vault/azure-secret-store/sql-username-1234"
  },
  "sql_connection_string_template": "vault/azure-secret-store/sql-connection-string-template-1234",
  "sql_connection_string_template_jdbc": "vault/azure-secret-store/sql-connection-string-template-jdbc-1234",
  "sql_connection_string_template_odbc": "vault/azure-secret-store/sql-connection-string-template-odbc-1234",
  "sql_connection_string_template_sqlalchemy_pyodbc": "vault/azure-secret-store/sql-connection-string-template-sqlalchemy-pyodbc-1234",
  "storage_class": "managed-premium",
  "storage_class_single_replica": "managed-premium",
  "telemetry_optout": true,
  "test_manager": {
    "enabled": true
  }
}

Configuring the Azure cloud environment

The environment_type field specifies which Azure cloud environment to use for Key Vault access. This field is optional and defaults to PublicCloud.

The following values are supported:

Value	Description
PublicCloud	Azure public cloud (default)
USGovernmentCloud	Azure US Government cloud
ChinaCloud	Azure China cloud
GermanCloud	Azure Germany cloud

Note:

The vault_url must match the Azure cloud environment. For example:

• Public cloud: https://<vault-name>.vault.azure.net/
• US Government: https://<vault-name>.vault.usgovcloudapi.net/
• China: https://<vault-name>.vault.azure.cn/
• Germany: https://<vault-name>.vault.microsoftazure.de/

The following example shows how to configure the environment_type field in input.json:

"secret_store": {
  "enabled": true,
  "provider_configs": [
    {
      "type": "azure",
      "credentials_secret_name": "azure-service-principal-secret",
      "refresh_interval": "5m",
      "name": "azure-secret-store",
      "environment_type": "USGovernmentCloud",
      "azure_kv": {
        "vault_url": "https://eso-azure-kv.vault.azure.net/",
        "tenant_id": "00000000-0000-0000-0000-000000000000"
      }
    }
  ]
}

Configuring external OCI-compliant private registry

When using a private registry, if you do not want to configure the registry credentials in input.json, you can provide them as a Kubernetes secret instead, as shown in the following example:

"registries": {
  "docker": {
    "pull_secret_name": "registry-credentials",
    "url": "sfbrdevhelmweacr.azurecr.io"
  }
}

Create the Kubernetes secret that stores the registry credentials, as shown in the following example:

apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
type: Opaque
data:
  url: base64Encode(sfbrdevhelmweacr.azurecr.io)
  username: base64Encode(<registry-username>)
  password: base64Encode(<registry-password>)

Apply the secret in the uipath namespace using the following command:

kubectl apply -f registry-credentials.yaml -n uipath