Skip to content

Commit d1655ae

Browse files
authored
chore(readme): adding readme for #440 (#444)
1 parent 1d767e3 commit d1655ae

1 file changed

Lines changed: 38 additions & 0 deletions

File tree

README.md

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ A helper action for easily pulling secrets from HashiCorp Vault™.
1919
- [GitHub](#github)
2020
- [JWT with OIDC Provider](#jwt-with-oidc-provider)
2121
- [Kubernetes](#kubernetes)
22+
- [Userpass](#userpass)
23+
- [Ldap](#ldap)
2224
- [Other Auth Methods](#other-auth-methods)
2325
- [Key Syntax](#key-syntax)
2426
- [Simple Key](#simple-key)
@@ -256,6 +258,40 @@ with:
256258
kubernetesTokenPath: /var/run/secrets/kubernetes.io/serviceaccount/token # default token path
257259
```
258260

261+
### Userpass
262+
263+
The [Userpass auth method](https://developer.hashicorp.com/vault/docs/auth/userpass) allows
264+
your GitHub Actions workflow to authenticate to Vault with a username and password.
265+
Set the username and password as GitHub secrets and pass them to the
266+
`username` and `password` parameters.
267+
268+
This is not the same as ldap or okta auth methods.
269+
270+
```yaml
271+
with:
272+
url: https://vault.mycompany.com:8200
273+
caCertificate: ${{ secrets.VAULT_CA_CERT }}
274+
method: userpass
275+
username: ${{ secrets.VAULT_USERNAME }}
276+
password: ${{ secrets.VAULT_PASSWORD }}
277+
```
278+
279+
### Ldap
280+
281+
The [LDAP auth method](https://developer.hashicorp.com/vault/docs/auth/ldap) allows
282+
your GitHub Actions workflow to authenticate to Vault with a username and password inturn verfied with ldap servers.
283+
Set the username and password as GitHub secrets and pass them to the
284+
`username` and `password` parameters.
285+
286+
```yaml
287+
with:
288+
url: https://vault.mycompany.com:8200
289+
caCertificate: ${{ secrets.VAULT_CA_CERT }}
290+
method: ldap
291+
username: ${{ secrets.VAULT_USERNAME }}
292+
password: ${{ secrets.VAULT_PASSWORD }}
293+
```
294+
259295
### Other Auth Methods
260296

261297
If any other method is specified and you provide an `authPayload`, the action will
@@ -437,6 +473,8 @@ Here are all the inputs available through `with`:
437473
| `jwtGithubAudience` | Identifies the recipient ("aud" claim) that the JWT is intended for |`sigstore`| |
438474
| `jwtTtl` | Time in seconds, after which token expires | | 3600 |
439475
| `kubernetesTokenPath` | The path to the service-account secret with the jwt token for kubernetes based authentication |`/var/run/secrets/kubernetes.io/serviceaccount/token` | |
476+
| `username` | The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
477+
| `password` | The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
440478
| `authPayload` | The JSON payload to be sent to Vault when using a custom authentication method. | | |
441479
| `extraHeaders` | A string of newline separated extra headers to include on every request. | | |
442480
| `exportEnv` | Whether or not export secrets as environment variables. | `true` | |

0 commit comments

Comments
 (0)