Secrets Manager can be configured by a user with write privileges. When configured, you can configure Netskope tenants, custom plugin repositories, and plugins using secrets from their configured Secrets Manager.
Configure Secrets Manager
- Go to Settings > General > Secret Manager.
- By default, the Secrets Manager is disabled. Enable the Secrets Manager toggle.
- Use the Provider dropdown to choose between HashiCorp Vault and Azure Key Vault.
HashiCorp Vault Configuration
- Provide the Vault URL and Namespace.
- Select an authentication method. Currently supported authentication methods are:
- Token:
https://developer.hashicorp.com/vault/docs/auth/token. - AppRole:
https://developer.hashicorp.com/vault/docs/auth/approle. - Username and Password:
https://developer.hashicorp.com/vault/docs/auth/userpass.
- Token:
- Provide the required parameters for the selected authentication method and click Save.
Azure Key Vault configuration
- Create a service principal with access to the Key Vault by following Azure Key Vault Prerequisites. Capture Application (client) ID, Directory (tenant) ID, Vault URI, and either a client secret or certificate.
- Enter the following parameters:
- Vault URL: The Vault URI from Azure.
- Tenant ID and Client ID: Values from the registered application.
- Enter the required parameters for the selected authentication method and click Save.
If using certificate-based authentication, paste the certificate file and provide the passphrase (if the certificate is encrypted).
Using Secrets Manager
When configured, you can provide paths of secrets from their configured Secrets Manager instead of directly providing the passwords. This will be applicable for all the password fields.
Secrets Manager can be linked to only one provider at a time. Before switching providers or disabling the feature, remove every configured secret reference across tenants, repositories, and plugins to avoid orphaned secrets. The provider toggle remains locked until all references are cleared.
You still have the option to directly provide the password value instead of the secret path by disabling the toggle.
You can use the Secrets Manager in any of the plugins in the similar manner.
