hasura / hasura/graphql-engine

Include Functionality for Hashicorp Vault

Open
#10,195 0 comments 0 reactions 0 assignees View on GitHub
k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Component

Securing Secrets and Keys

### Is your proposal related to a problem?

No

### Describe the solution you'd like

Looking for a mechanism to load secrets such as Hasura Admin keys, EE licenses and secrets from a file (secret mount) at runtime rather than injecting them as ENV Vars which is a security concern for sensitive information leakage.

Would be great to get a fromFile option supported which could be pointed to a secret mount or a location at runtime which ideally be integrated with AWS secrets manager or Hashicorp Vault or K8s secrets etc.

### Describe alternatives you've considered

N/A

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating the existing environment-variable handling for Hasura Admin keys, EE licenses, and secrets; done should include a defined fromFile mechanism that supports runtime secret mounts and the proposed AWS Secrets Manager, Hashicorp Vault, or Kubernetes secret sources.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, typescript
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.