Backstage Vault Plugin

Install the frontend package

1. From your Backstage root run

   Copy

   yarn --cwd packages/app add @backstage-community/plugin-vault

Add the card in a classic app

1. Open packages/app/src/components/catalog/EntityPage.tsx

2. Import the card

   Copy

   import { EntityVaultCard } from '@backstage-community/plugin-vault';

3. Render the card in the overview tab

   Copy

   // packages/app/src/components/catalog/EntityPage.tsx
   
   const overviewContent = (
     <Grid container spacing={3} alignItems="stretch">
       {/* other content */}
       <Grid item md={6} xs={12}>
         <EntityVaultCard />
       </Grid>
     </Grid>
   );

Enable the plugin in the new frontend system

1. Keep the same package install as above

2. Open packages/app or packages/app-next then src/App.tsx

3. Import the plugin and register it in createApp

   Copy

   // packages/app/src/App.tsx or packages/app-next/src/App.tsx
   
   import vaultPlugin from '@backstage-community/plugin-vault/alpha';
   
   export const app = createApp({
     features: [
       catalogPlugin,
       catalogImportPlugin,
       userSettingsPlugin,
       vaultPlugin,
     ],
   });

Configure Vault

1. Open app-config.yaml

2. Add the vault config

   Copy

   vault:
     baseUrl: http://your-vault-url
     token: ${VAULT_TOKEN}
     secretEngine: secrets # optional
     kvVersion: 2 # optional values are 1 or 2

   You can set VAULT_TOKEN in your runtime environment

Annotate catalog entities

1. Add annotations to each entity that should show secrets

   Copy

   apiVersion: backstage.io/v1alpha1
   kind: Component
   metadata:
     name: my-service
     annotations:
       vault.io/secrets-path: test/backstage
       vault.io/secrets-engine: customSecretEngine # optional
   spec:
     type: service
     owner: team-a
     lifecycle: production

   The secrets path is relative to your secret engine folder

Optional policy for token renew

1. If you want token renew to work add this to your Vault policy

   Copy

   # Allow tokens to renew themselves
   path "auth/token/renew-self" {
     capabilities = ["update"]
   }

Backend setup

There is no backend plugin to install for this feature. The frontend calls Vault using the config above. This applies to both the classic app and the new frontend system.