Add support for multiple secret formats

Oct 13, 2025 by wbrum.org 130 views

Introduction

In the world of cloud computing and infrastructure management, secrets play a crucial role in securing sensitive information. However, the current implementation of the provider-vault in Upbound only allows reading secrets in JSON format, which can be limiting for users who need to work with secrets in other formats. In this article, we will explore the problem of reading secrets in non-JSON format and propose a solution to make the provider-vault more user-friendly.

The Problem

The provider-vault can only read secrets that are in JSON format. This means that secrets created from resources using writeConnectionSecretToRef or plain secrets cannot be used directly and need to be transformed in some way. For example, a secret written by the provider-azure-dbforpostgresql FlexibleServer resource has to be transformed before it can be used by the vault-provider.

### Example Secret in Non-JSON Format

```yaml
apiVersion: v1
kind: Secret
data:
  attribute.administrator_password: ZHVtbXktcGFzcyB3YXMK
  endpoint: QUJCQSB3YXMgaGVyZQo=
  password: ZHVtbXktcGFzcyB3YXMK
  port: NDIK
  username: TktPVEIK
metadata:
  name: postgresql-connection-secrets
  namespace: default
type: connection.crossplane.io/v1alpha1

As you can see, the secret is in key-value format, which is not compatible with the current implementation of the provider-vault.

The Solution

To solve this problem, we propose introducing a more user-friendly API that allows the provider-vault to read secrets in key-value format. This API should be able to handle secrets in various formats, including JSON, key-value, and others.

Benefits of the Solution

The proposed solution has several benefits:

Improved User Experience: The new API will make it easier for users to work with secrets in non-JSON format, reducing the need for manual transformations and making the provider-vault more user-friendly.
Increased Flexibility: The new API will allow the provider-vault to handle secrets in various formats, making it more flexible and adaptable to different use cases.
Better Security: By allowing secrets to be stored in non-JSON format, the new API will provide an additional layer of security, as secrets will be less vulnerable to attacks that rely on JSON format.

Implementation

To implement the proposed solution, we will need to make the following changes:

Update the provider-vault API: We will need to update the provider-vault API to support reading secrets in key-value format.
Add support for multiple secret formats: We will need to add support for multiple secret formats, including JSON, key-value, and others.
Implement secret transformations: We will need to implement secret transformations to convert secrets from one format to another.

Conclusion

In conclusion, the current implementation of the provider-vault only allows reading secrets in JSON format, which can be limiting for users who need to work with secrets in other formats. By introducing a more user-friendly API that allows the provider-vault to read secrets in key-value format, we can improve the user experience, increase flexibility, and provide better security. We believe that this solution will make the provider-vault more user-friendly and adaptable to different use cases.

Future Work

In the future, we plan to:

Add support for more secret formats: We will continue to add support for more secret formats, including XML, YAML, and others.
Implement secret encryption: We will implement secret encryption to provide an additional layer of security.
Improve the provider-vault API: We will continue to improve the provider-vault API to make it more user-friendly and adaptable to different use cases.

Epic

Epic # [insert epic number]

References

provider-azure-dbforpostgresql FlexibleServer
Allow Secrets in Non-JSON Format for the Provider: Q&A =====================================================

Introduction

In our previous article, we discussed the problem of reading secrets in non-JSON format and proposed a solution to make the provider-vault more user-friendly. In this article, we will answer some frequently asked questions (FAQs) related to the proposed solution.

Q: What is the current limitation of the provider-vault?

A: The current limitation of the provider-vault is that it only allows reading secrets in JSON format. This means that secrets created from resources using writeConnectionSecretToRef or plain secrets cannot be used directly and need to be transformed in some way.

Q: Why is it necessary to support non-JSON secret formats?

A: Supporting non-JSON secret formats is necessary because it will make the provider-vault more user-friendly and adaptable to different use cases. It will also provide an additional layer of security, as secrets will be less vulnerable to attacks that rely on JSON format.

Q: How will the proposed solution improve the user experience?

A: The proposed solution will improve the user experience by making it easier for users to work with secrets in non-JSON format. It will reduce the need for manual transformations and make the provider-vault more user-friendly.

Q: What are the benefits of the proposed solution?

A: The proposed solution has several benefits, including:

Improved User Experience: The new API will make it easier for users to work with secrets in non-JSON format, reducing the need for manual transformations and making the provider-vault more user-friendly.
Increased Flexibility: The new API will allow the provider-vault to handle secrets in various formats, making it more flexible and adaptable to different use cases.
Better Security: By allowing secrets to be stored in non-JSON format, the new API will provide an additional layer of security, as secrets will be less vulnerable to attacks that rely on JSON format.

Q: How will the proposed solution be implemented?

A: To implement the proposed solution, we will need to make the following changes:

Update the provider-vault API: We will need to update the provider-vault API to support reading secrets in key-value format.
Add support for multiple secret formats: We will need to add support for multiple secret formats, including JSON, key-value, and others.
Implement secret transformations: We will need to implement secret transformations to convert secrets from one format to another.

Q: What are the next steps for the proposed solution?

A: The next steps for the proposed solution are:

Add support for more secret formats: We will continue to add support for more secret formats, including XML, YAML, and others.
Implement secret encryption: We will implement secret encryption to provide an additional layer of security.
Improve the provider-vault API: We will continue to improve the provider-vault API to make it more user-friendly and adaptable to different use cases.

Q: What is the expected timeline for the proposed solution?

A: The expected timeline for the proposed solution is:

Short-term: We expect to add support for key-value secret format within the next 2-3 months.
Medium-term: We expect to add support for more secret formats, including XML, YAML, and others, within the next 6-9 months.
Long-term: We expect to implement secret encryption and improve the provider-vault API within the next 12-18 months.

Conclusion

In conclusion, the proposed solution to allow secrets in non-JSON format for the provider-vault will improve the user experience, increase flexibility, and provide better security. We believe that this solution will make the provider-vault more user-friendly and adaptable to different use cases.

References

provider-azure-dbforpostgresql FlexibleServer