Skip to navigation
Command referenceiagctl create

iagctl create secret-provider

Gateway 5.5+

Create a named secret provider configuration in Itential Gateway.

A secret provider stores the connection and authentication settings for an external secrets manager. Once created, you can reference a provider when creating secret aliases using iagctl create secret --provider <name>.

For more information, see External secrets overview.

Syntax

iagctl create secret-provider <name> --type <provider-type> [flags]

Provider types

TypeDescription
vaultHashiCorp Vault KV Secrets Engine v2. Supports token authentication and AppRole authentication.
cyberarkCyberArk Central Credential Provider (CCP) with mutual TLS client certificate authentication.
pluginCustom subprocess-based provider. Use this type to connect to any secrets manager not covered by the bundled providers.

Examples

Create a Vault provider with AppRole authentication

iagctl create secret-provider prod-vault \
  --type vault \
  --url https://vault.example.com:8200 \
  --auth-method approle \
  --role-id <role-id-uuid> \
  --secret-id-file /etc/gateway/secret_id \
  --secrets-endpoint itential/data

Create a Vault provider with token authentication

iagctl create secret-provider dev-vault \
  --type vault \
  --url https://vault.dev.example.com:8200 \
  --auth-method token \
  --token /etc/gateway/vault_token \
  --secrets-endpoint itential/data

Create a CyberArk CCP provider

iagctl create secret-provider cyberark-prod \
  --type cyberark \
  --url https://cyberark.company.com/AIMWebService \
  --app-id Itential-Gateway \
  --cert-file /etc/pki/cyberark/cert.pem \
  --key-file /etc/pki/cyberark/key.pem \
  --ca /etc/pki/cyberark/ca.pem

Create a plugin provider

iagctl create secret-provider my-plugin \
  --type plugin \
  --command /opt/itential/plugins/secrets-plugin \
  --env VAULT_ADDR=https://vault.example.com:8200 \
  --env VAULT_SECRETS_ENDPOINT=itential/data \
  --env VAULT_TOKEN_FILE=/etc/gateway/vault_token

Options

  --type string   The provider type: vault, cyberark, or plugin (required)
  -h, --help      Help for secret-provider

Vault options

Never pass credentials as command-line values. Store tokens and key files on disk and reference them by file path.

  --url string              Vault server URL
  --auth-method string      Authentication method: token or approle
  --token string            Path to the Vault token file (token auth)
  --role-id string          AppRole role ID value (approle auth)
  --secret-id string        AppRole secret ID inline value (approle auth)
  --secret-id-file string   Path to the AppRole secret ID file (approle auth, preferred)
  --secrets-endpoint string Mount path for the Vault KV v2 secrets engine (e.g. itential/data). This path is prepended automatically to the --secret value when creating a secret alias against this provider.

CyberArk options

  --url string                CyberArk CCP server URL, including the AIMWebService base path
  --app-id string             CyberArk application ID for this Gateway instance
  --cert-file string          Path to the client certificate file
  --key-file string           Path to the private key file
  --ca string                 Path to the CA certificate file
  --allow-invalid-certs       Skip TLS certificate verification (development environments only)

Plugin options

  --command string      Path to the plugin executable on the gateway server
  --env stringArray     Non-sensitive configuration passed to the plugin at invocation time, in KEY=VALUE format; repeatable

Options inherited from parent commands

  --profile string   Specify the client profile to use (case-insensitive, defaults to [client] section)
  --config string    Path to the configuration file
  --raw              Display the result of the command in raw format
  --verbose          Enable verbose output