Retrieve Postgres database password from Hashicorp Vault at runtime or from a file?

[jfreeman-hbo]

Hi,

We are using this Helm Chart, K8s and EKS to deploy out apicurio in Kubernetes.

I was wondering if it is possible to pull the database password from Hashicorp Vault at runtime? IE: something like this:
https://quarkiverse.github.io/quarkiverse-docs/quarkus-vault/dev/vault-datasource.html

Or use an initContainer to mount a volume with a file containing the db password secret that can be read into the REGISTRY_DATASOURCE_PASSWORD env variable?

Or other options or examples to externalize the database password in Vault?

[carlesarnal]

Hi @jfreeman-hbo, reading the password from a secret is indeed possible, for example, in my openshift deployments, I usually have a key/pair secret with the user and password and then load the password (and user) with the following syntax:

- name: REGISTRY_DATASOURCE_PASSWORD
    valueFrom:
       secretKeyRef:
          name: $YOUR_SECRET_NAME
          key: $PASSWORD_KEY_IN_SECRET

This approach should work for the initContainer approach.

About the second option, using a custom credentials provider is not supported out of the box in Registry, but, given its nature, it should work with a custom build. That said, you can still use Vault to create and load the secrets using the approach I described above.

Thanks!