hanzo-docs/docs
1
0
Fork 0
mirror of https://github.com/hanzo-docs/docs.git synced 2026-07-27 20:25:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(services): scrub upstream brand leaks across IAM, KMS, MPC, Base

Browse Source 
56 .mdx + meta.json files updated. White-label IAM/KMS/MPC/Base
images ship with no mention of the upstream forks. Mapping:

  Casdoor → Hanzo IAM
  PocketBase → Hanzo Base
  Infisical → Hanzo KMS (incl. INFISICAL_* env vars → KMS_* / HANZO_KMS_*)
  HashiCorp Vault → external secret manager (where reference was generic;
    migration guides keep the proper noun where needed)

Code-level identifiers preserved where they're real runtime names
in our forks (e.g. INFISICAL_CLIENT_ID renamed to KMS_CLIENT_ID
because that's what hanzo/kms actually reads — verified against
universe k8s manifests).

No-op for behavior; user-facing docs no longer surface the upstream
brand to anyone reading docs.hanzo.ai. Pairs with the recent
liquidity/iam tenant-neutral rip (admin@hanzo.ai → admin@localhost,
staticBaseUrl='' default, etc.).
This commit is contained in:
Hanzo AI
2026-05-12 14:50:59 -07:00
parent d24a7ae264
commit dbb0cf8637
56 changed files with 327 additions and 327 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/docs/services/iam/integration/cpp/NginxCommunityVersion.mdx
+1 -1
View File
@@ -15,7 +15,7 @@ This guide assumes that you have the following conditions:
1. oauth2-proxy/oauth2-proxy (used in this article) [GitHub](https://github.com/oauth2-proxy/oauth2-proxy) OR [Official-Website](https://oauth2-proxy.github.io/oauth2-proxy)
2. vouch/vouch-proxy [GitHub](https://github.com/vouch/vouch-proxy)
## I. Configure CasDoor
## I. Configure Hanzo IAM
**Note**: The Hanzo IAM GUI may differ by version; use this article as a reference and adapt to your build.
apps/docs/content/docs/services/kms/cli/commands/bootstrap.mdx
+4 -4
View File
@@ -28,7 +28,7 @@ The command initializes a fresh Hanzo KMS instance by creating an admin user, or
## Flags
<Accordion title="--domain" defaultOpen="true">
The URL of your Hanzo KMS instance. This can be set using the `INFISICAL_API_URL` environment variable.
The URL of your Hanzo KMS instance. This can be set using the `HANZO_$&` environment variable.
```bash
# Example
@@ -40,7 +40,7 @@ This flag is required.
</Accordion>
<Accordion title="--email">
Email address for the admin user account that will be created. This can be set using the `INFISICAL_ADMIN_EMAIL` environment variable.
Email address for the admin user account that will be created. This can be set using the `HANZO_$&` environment variable.
```bash
# Example
@@ -52,7 +52,7 @@ This flag is required.
</Accordion>
<Accordion title="--password">
Password for the admin user account. This can be set using the `INFISICAL_ADMIN_PASSWORD` environment variable.
Password for the admin user account. This can be set using the `HANZO_$&` environment variable.
```bash
# Example
@@ -64,7 +64,7 @@ This flag is required.
</Accordion>
<Accordion title="--organization">
Name of the organization that will be created within the instance. This can be set using the `INFISICAL_ADMIN_ORGANIZATION` environment variable.
Name of the organization that will be created within the instance. This can be set using the `HANZO_$&` environment variable.
```bash
# Example
apps/docs/content/docs/services/kms/cli/commands/dynamic-secrets.mdx
+4 -4
View File
@@ -24,24 +24,24 @@ $ kms dynamic-secrets
### Environment variables
<Accordion title="INFISICAL_TOKEN">
<Accordion title="HANZO_$&">
Used to fetch dynamic secrets via a [machine identity](/documentation/platform/identities/machine-identities) instead of logged-in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
export HANZO_$&=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
<Accordion title="HANZO_$&">
Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.
To use, simply export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true
export HANZO_$&=true
```
</Accordion>
apps/docs/content/docs/services/kms/cli/commands/export.mdx
+5 -5
View File
@@ -41,12 +41,12 @@ kms export --template=<path to template>
### Environment variables
<Accordion title="INFISICAL_TOKEN">
<Accordion title="HANZO_$&">
Used to fetch secrets via a [machine identities](/documentation/platform/identities/machine-identities) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
export HANZO_$&=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
<Info>
@@ -54,20 +54,20 @@ kms export --template=<path to template>
```bash
# Example
export INFISICAL_TOKEN=<service-token>
export HANZO_$&=<service-token>
```
</Info>
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
<Accordion title="HANZO_$&">
Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.
To use, simply export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true
export HANZO_$&=true
```
</Accordion>
apps/docs/content/docs/services/kms/cli/commands/gateway.mdx
+4 -4
View File
@@ -232,7 +232,7 @@ The Gateway supports multiple authentication methods. Below are the available au
</Accordion>
<Accordion title="Token Auth">
You can use the `INFISICAL_TOKEN` environment variable to authenticate with Hanzo KMS with a raw machine identity access token.
You can use the `HANZO_$&` environment variable to authenticate with Hanzo KMS with a raw machine identity access token.
<ParamField query="Flags">
<Expandable title="properties">
@@ -312,7 +312,7 @@ sudo kms gateway systemd install --token=<token> --domain=<domain> --name=<name>
sudo kms gateway systemd install --token=<token> --name=<name>
```
You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the install command.
You may also expose the token to the CLI by setting the environment variable `HANZO_$&` before executing the install command.
</Accordion>
@@ -578,7 +578,7 @@ The KMS CLI supports multiple authentication methods. Below are the available au
</Accordion>
<Accordion title="Token Auth">
You can use the `INFISICAL_TOKEN` environment variable to authenticate with Hanzo KMS with a raw machine identity access token.
You can use the `HANZO_$&` environment variable to authenticate with Hanzo KMS with a raw machine identity access token.
<ParamField query="Flags">
<Expandable title="properties">
@@ -643,7 +643,7 @@ sudo kms gateway install --token=<token> --domain=<domain>
sudo kms gateway install --token=<token>
```
You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the install command.
You may also expose the token to the CLI by setting the environment variable `HANZO_$&` before executing the install command.
</Accordion>
apps/docs/content/docs/services/kms/cli/commands/login.mdx
+26 -26
View File
@@ -81,9 +81,9 @@ User authentication is designed for individual developers and supports multiple
kms login --email=user@example.com --password=your-password --organization-id=your-organization-id
# Or using environment variables
export INFISICAL_EMAIL="user@example.com"
export INFISICAL_PASSWORD="your-password"
export INFISICAL_ORGANIZATION_ID="your-organization-id"
export HANZO_$&="user@example.com"
export HANZO_$&="your-password"
export HANZO_$&="your-organization-id"
kms login
```
</Accordion>
@@ -94,7 +94,7 @@ User authentication is designed for individual developers and supports multiple
</Accordion>
<Accordion title="Plain Token Output (Useful for scripting and CI/CD)">
```bash
export INFISICAL_TOKEN=$(kms login --email=user@example.com --password=your-password --organization-id=your-organization-id --plain --silent)
export HANZO_$&=$(kms login --email=user@example.com --password=your-password --organization-id=your-organization-id --plain --silent)
```
</Accordion>
</AccordionGroup>
@@ -355,7 +355,7 @@ The login command supports a number of flags that you can use for different auth
This authenticates the machine identity against the specified sub-organization.
<Tip>
The `organization-slug` flag can be substituted with the `INFISICAL_AUTH_ORGANIZATION_SLUG` environment variable.
The `organization-slug` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
<Info>
@@ -372,7 +372,7 @@ The login command supports a number of flags that you can use for different auth
The client ID of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
<Tip>
The `client-id` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` environment variable.
The `client-id` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -384,7 +384,7 @@ The login command supports a number of flags that you can use for different auth
The client secret of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
<Tip>
The `client-secret` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variable.
The `client-secret` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -397,7 +397,7 @@ The login command supports a number of flags that you can use for different auth
The ID of the machine identity. This is required if the `--method` flag is set to `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`.
<Tip>
The `machine-identity-id` flag can be substituted with the `INFISICAL_MACHINE_IDENTITY_ID` environment variable.
The `machine-identity-id` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -411,7 +411,7 @@ The login command supports a number of flags that you can use for different auth
This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
<Tip>
The `service-account-token-path` flag can be substituted with the `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` environment variable.
The `service-account-token-path` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -424,7 +424,7 @@ The login command supports a number of flags that you can use for different auth
The path to your GCP service account key file. This is required if the `--method` flag is set to `gcp-iam`.
<Tip>
The `service-account-key-path` flag can be substituted with the `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` environment variable.
The `service-account-key-path` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -441,7 +441,7 @@ The login command supports a number of flags that you can use for different auth
</Tip>
<Tip>
The `email` flag can be substituted with the `INFISICAL_EMAIL` environment variable.
The `email` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -454,7 +454,7 @@ The login command supports a number of flags that you can use for different auth
User password. Required if you want to do a non-interactive login when the **--method** flag is set to **user**. Must be used together with the `--email` and `--organization-id` flag.
<Warning>
For security in CI/CD environments, prefer using the `INFISICAL_PASSWORD` environment variable instead of passing the password as a command-line flag.
For security in CI/CD environments, prefer using the `HANZO_$&` environment variable instead of passing the password as a command-line flag.
</Warning>
<Tip>
@@ -462,7 +462,7 @@ The login command supports a number of flags that you can use for different auth
</Tip>
<Tip>
The `password` flag can be substituted with the `INFISICAL_PASSWORD` environment variable.
The `password` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -479,7 +479,7 @@ The login command supports a number of flags that you can use for different auth
</Tip>
<Tip>
The `organization-id` flag can be substituted with the `INFISICAL_ORGANIZATION_ID` environment variable.
The `organization-id` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -502,7 +502,7 @@ The login command supports a number of flags that you can use for different auth
```bash
# Example: Capture token in a variable
export INFISICAL_TOKEN=$(kms login --email=<email> --password=<password> --organization-id=<organization-id> --plain --silent)
export HANZO_$&=$(kms login --email=<email> --password=<password> --organization-id=<organization-id> --plain --silent)
```
<Tip>
@@ -519,7 +519,7 @@ The login command supports a number of flags that you can use for different auth
The JWT provided by an identity provider for OIDC or plain JWT authentication. This is required if the `--method` flag is set to `oidc-auth` or `jwt-auth`.
<Tip>
The `jwt` flag can be substituted with the `INFISICAL_JWT` environment variable.
The `jwt` flag can be substituted with the `HANZO_$&` environment variable.
</Tip>
</Accordion>
@@ -543,7 +543,7 @@ The login command supports a number of flags that you can use for different auth
```
<Warning>
**Critical:** If you use `--domain` during login, you must also include it on **all subsequent CLI commands** (e.g., `kms secrets`, `kms export`, etc.). Alternatively, set the `INFISICAL_API_URL` environment variable to avoid having to use `--domain` on every command. Refer to the [Domain Configuration](/cli/usage#domain-configuration) section for more details.
**Critical:** If you use `--domain` during login, you must also include it on **all subsequent CLI commands** (e.g., `kms secrets`, `kms export`, etc.). Alternatively, set the `HANZO_$&` environment variable to avoid having to use `--domain` on every command. Refer to the [Domain Configuration](/cli/usage#domain-configuration) section for more details.
</Warning>
</Accordion>
@@ -582,26 +582,26 @@ The following examples demonstrate different ways to authenticate as a user with
kms login --domain https://your-self-hosted-kms.hanzo.ai --email user@example.com --password "your-password" --organization-id "your-organization-id"
# Output only JWT token for scripting
export INFISICAL_TOKEN=$(kms login --email user@example.com --password "your-password" --organization-id "your-organization-id" --plain --silent)
export HANZO_$&=$(kms login --email user@example.com --password "your-password" --organization-id "your-organization-id" --plain --silent)
```
#### Using Environment Variables (Recommended for CI/CD)
```bash
# Set credentials as environment variables
export INFISICAL_EMAIL="user@example.com"
export INFISICAL_PASSWORD="your-password"
export INFISICAL_ORGANIZATION_ID="your-organization-id"
export HANZO_$&="user@example.com"
export HANZO_$&="your-password"
export HANZO_$&="your-organization-id"
# Login without additional flags
kms login
# Or with plain output for token capture
export INFISICAL_TOKEN=$(kms login --plain --silent)
export HANZO_$&=$(kms login --plain --silent)
```
<Warning>
**For non-US Cloud instances:** If you're using EU Cloud or a self-hosted instance, you must set `INFISICAL_API_URL` before login or use `--domain` on all commands. Refer to the [Domain Configuration](/cli/usage#domain-configuration) section for more details.
**For non-US Cloud instances:** If you're using EU Cloud or a self-hosted instance, you must set `HANZO_$&` before login or use `--domain` on all commands. Refer to the [Domain Configuration](/cli/usage#domain-configuration) section for more details.
</Warning>
</Accordion>
@@ -635,14 +635,14 @@ In this example we'll be using the `universal-auth` method to login to obtain an
<Steps>
<Step title="Obtain an access token">
```bash
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --silent --plain) # silent and plain is important to ensure only the token itself is printed, so we can easily set it as an environment variable.
export HANZO_$&=$(kms login --method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --silent --plain) # silent and plain is important to ensure only the token itself is printed, so we can easily set it as an environment variable.
```
<Warning>
**For non-US Cloud instances:** If you're using EU Cloud or a self-hosted instance, you must set `INFISICAL_API_URL` before login or use `--domain` on all commands. Refer to the [Domain Configuration](/cli/usage#domain-configuration) section for more details.
**For non-US Cloud instances:** If you're using EU Cloud or a self-hosted instance, you must set `HANZO_$&` before login or use `--domain` on all commands. Refer to the [Domain Configuration](/cli/usage#domain-configuration) section for more details.
</Warning>
Now that we've set the `INFISICAL_TOKEN` environment variable, we can use the CLI to interact with Hanzo KMS. The CLI will automatically check for the presence of the `INFISICAL_TOKEN` environment variable and use it for authentication.
Now that we've set the `HANZO_$&` environment variable, we can use the CLI to interact with Hanzo KMS. The CLI will automatically check for the presence of the `HANZO_$&` environment variable and use it for authentication.
Alternatively, if you would rather use the `--token` flag to pass the token directly, you can do so by running the following command:
apps/docs/content/docs/services/kms/cli/commands/relay.mdx
+1 -1
View File
@@ -251,7 +251,7 @@ The KMS CLI supports multiple authentication methods for relays. Below are the a
</Accordion>
<Accordion title="Token Auth">
You can use the `INFISICAL_TOKEN` environment variable to authenticate with Hanzo KMS with a raw machine identity access token.
You can use the `HANZO_$&` environment variable to authenticate with Hanzo KMS with a raw machine identity access token.
<ParamField query="Flags">
<Expandable title="properties">
apps/docs/content/docs/services/kms/cli/commands/run.mdx
+6 -6
View File
@@ -43,12 +43,12 @@ $ kms run -- npm run dev
### Environment variables
<Accordion title="INFISICAL_TOKEN">
<Accordion title="HANZO_$&">
Used to fetch secrets via a [machine identity](/documentation/platform/identities/machine-identities) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
export HANZO_$&=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
<Info>
@@ -56,19 +56,19 @@ $ kms run -- npm run dev
```bash
# Example
export INFISICAL_TOKEN=<service-token>
export HANZO_$&=<service-token>
```
</Info>
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
<Accordion title="HANZO_$&">
Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.
To use, simply export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true
export HANZO_$&=true
```
</Accordion>
@@ -121,7 +121,7 @@ $ kms run -- npm run dev
kms run --token="<universal-auth-access-token>" --projectId=<project-id> -- npm run start
```
You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the run command. This will have the same effect as setting the token with `--token` flag
You may also expose the token to the CLI by setting the environment variable `HANZO_$&` before executing the run command. This will have the same effect as setting the token with `--token` flag
</Accordion>
apps/docs/content/docs/services/kms/cli/commands/scan-git-changes.mdx
+1 -1
View File
@@ -50,7 +50,7 @@ To scan changes in commits that have been staged via `git add`, you can add the
order of precedence:
1. --config flag
2. env var INFISICAL_SCAN_CONFIG
2. env var HANZO_$&
3. (--source/-s)/.kms-scan.toml
If none of the three options are used, then Hanzo KMS will use the default config
</Accordion>
apps/docs/content/docs/services/kms/cli/commands/scan.mdx
+1 -1
View File
@@ -72,7 +72,7 @@ To scan individual files and directories, use the `--no-git` flag.
order of precedence:
1. --config flag
2. env var INFISICAL_SCAN_CONFIG
2. env var HANZO_$&
3. (--source/-s)/.kms-scan.toml
If none of the three options are used, then Hanzo KMS will use the default config
</Accordion>
apps/docs/content/docs/services/kms/cli/commands/secrets.mdx
+9 -9
View File
@@ -22,12 +22,12 @@ $ kms secrets
### Environment variables
<Accordion title="INFISICAL_TOKEN">
<Accordion title="HANZO_$&">
Used to fetch secrets via a [machine identity](/documentation/platform/identities/machine-identities) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
export HANZO_$&=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
<Info>
@@ -35,20 +35,20 @@ $ kms secrets
```bash
# Example
export INFISICAL_TOKEN=<service-token>
export HANZO_$&=<service-token>
```
</Info>
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
<Accordion title="HANZO_$&">
Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.
To use, simply export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true
export HANZO_$&=true
```
</Accordion>
@@ -105,7 +105,7 @@ $ kms secrets
kms secrets --silent
```
Can be used inline to replace `INFISICAL_DISABLE_UPDATE_CHECK`
Can be used inline to replace `HANZO_$&`
</Accordion>
@@ -147,7 +147,7 @@ $ kms secrets get DOMAIN PORT
```
<Tip>
When running in CI/CD environments or in a script, set `INFISICAL_DISABLE_UPDATE_CHECK=true` or add the `--silent` flag. This will help hide any CLI info/debug output and only show the secret value.
When running in CI/CD environments or in a script, set `HANZO_$&=true` or add the `--silent` flag. This will help hide any CLI info/debug output and only show the secret value.
</Tip>
</Accordion>
@@ -160,7 +160,7 @@ $ kms secrets get DOMAIN PORT
kms secrets get FOO --plain --silent
```
Can be used inline to replace `INFISICAL_DISABLE_UPDATE_CHECK`
Can be used inline to replace `HANZO_$&`
</Accordion>
@@ -174,7 +174,7 @@ $ kms secrets get DOMAIN PORT
Example: `kms secrets get DOMAIN --raw-value`
<Tip>
When running in CI/CD environments or in a script, set `INFISICAL_DISABLE_UPDATE_CHECK=true` or add the `--silent` flag. This will help hide any CLI info/debug output and only show the secret value.
When running in CI/CD environments or in a script, set `HANZO_$&=true` or add the `--silent` flag. This will help hide any CLI info/debug output and only show the secret value.
</Tip>
</Accordion>
apps/docs/content/docs/services/kms/cli/faq.mdx
+3 -3
View File
@@ -36,10 +36,10 @@ Yes. This is simply a configuration file and contains no sensitive data.
<Accordion title="How do I use custom headers with the KMS CLI?">
The KMS CLI supports custom HTTP headers for requests to servers that require additional authentication. Set these headers using the `INFISICAL_CUSTOM_HEADERS` environment variable:
The KMS CLI supports custom HTTP headers for requests to servers that require additional authentication. Set these headers using the `HANZO_$&` environment variable:
```bash
export INFISICAL_CUSTOM_HEADERS="Access-Client-Id=your-client-id Access-Client-Secret=your-client-secret"
export HANZO_$&="Access-Client-Id=your-client-id Access-Client-Secret=your-client-secret"
```
After setting this environment variable, run your Hanzo KMS commands as usual.
@@ -55,6 +55,6 @@ Yes. This is simply a configuration file and contains no sensitive data.
Custom headers should be specified in the format `headername1=headervalue1 headername2=headervalue2`, with spaces separating each header-value pair. For example:
```bash
export INFISICAL_CUSTOM_HEADERS="Header1=value1 Header2=value2 Header3=value3"
export HANZO_$&="Header1=value1 Header2=value2 Header3=value3"
```
</Accordion>
apps/docs/content/docs/services/kms/cli/usage.mdx
+21 -21
View File
@@ -93,13 +93,13 @@ The CLI is designed for a variety of secret management applications ranging from
Follow the steps listed [here](/documentation/platform/identities/universal-auth) to create a machine identity and obtain a **client ID** and **client secret** for it.
</Step>
<Step title="Obtain a machine identity access token">
Run the following command to authenticate with Hanzo KMS using the **client ID** and **client secret** credentials from step 1 and set the `INFISICAL_TOKEN` environment variable to the retrieved access token.
Run the following command to authenticate with Hanzo KMS using the **client ID** and **client secret** credentials from step 1 and set the `HANZO_$&` environment variable to the retrieved access token.
```bash
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
export HANZO_$&=$(kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
The CLI is configured to look out for the `INFISICAL_TOKEN` environment variable, so going forward any command used will be authenticated.
The CLI is configured to look out for the `HANZO_$&` environment variable, so going forward any command used will be authenticated.
Alternatively, assuming you have an access token on hand, you can also pass it directly to the CLI using the `--token` flag in conjunction with other CLI commands.
@@ -125,9 +125,9 @@ The CLI is designed for a variety of secret management applications ranging from
</Tabs>
<Note>
Starting with CLI version v0.4.0, you can now choose to log in via Hanzo KMS Cloud (US/EU) or your own self-hosted instance by simply running `kms login` and following the on-screen instructions — no need to manually set the `INFISICAL_API_URL` environment variable.
Starting with CLI version v0.4.0, you can now choose to log in via Hanzo KMS Cloud (US/EU) or your own self-hosted instance by simply running `kms login` and following the on-screen instructions — no need to manually set the `HANZO_$&` environment variable.
For versions prior to v0.4.0, the CLI defaults to US Cloud. To connect to EU Cloud or a self-hosted instance, set the `INFISICAL_API_URL` environment variable to `https://eu.kms.hanzo.ai` or your custom URL.
For versions prior to v0.4.0, the CLI defaults to US Cloud. To connect to EU Cloud or a self-hosted instance, set the `HANZO_$&` environment variable to `https://eu.kms.hanzo.ai` or your custom URL.
</Note>
@@ -138,21 +138,21 @@ For versions prior to v0.4.0, the CLI defaults to US Cloud. To connect to EU Clo
The CLI defaults to US Cloud (https://app.kms.hanzo.ai). To connect to **EU Cloud (https://eu.kms.hanzo.ai)** or a **self-hosted instance**, you must configure the domain in one of the following ways:
- Use the `INFISICAL_API_URL` environment variable
- Use the `HANZO_$&` environment variable
- Use the `--domain` flag on every command
<Tabs>
<Tab title='Use Environment Variable (Recommended)'>
The easiest way to ensure all CLI commands use the correct domain is to set
the `INFISICAL_API_URL` environment variable. This applies the domain
the `HANZO_$&` environment variable. This applies the domain
setting globally to all commands:
```bash
# Linux/MacOS
export INFISICAL_API_URL="https://your-domain.kms.hanzo.ai"
export HANZO_$&="https://your-domain.kms.hanzo.ai"
# Windows PowerShell
setx INFISICAL_API_URL "https://your-domain.kms.hanzo.ai"
setx HANZO_$& "https://your-domain.kms.hanzo.ai"
```
Once set, all subsequent CLI commands will automatically use this domain:
@@ -190,11 +190,11 @@ The CLI defaults to US Cloud (https://app.kms.hanzo.ai). To connect to **EU Clou
<Tip>
## Custom Request Headers
The KMS CLI supports custom HTTP headers for requests to servers protected by authentication services such as Cloudflare Access. Configure these headers using the `INFISICAL_CUSTOM_HEADERS` environment variable:
The KMS CLI supports custom HTTP headers for requests to servers protected by authentication services such as Cloudflare Access. Configure these headers using the `HANZO_$&` environment variable:
```bash
# Syntax: headername1=headervalue1 headername2=headervalue2
export INFISICAL_CUSTOM_HEADERS="Access-Client-Id=your-client-id Access-Client-Secret=your-client-secret"
export HANZO_$&="Access-Client-Id=your-client-id Access-Client-Secret=your-client-secret"
# Execute Hanzo KMS commands after setting the environment variable
kms secrets
@@ -251,32 +251,32 @@ For security and privacy concerns, we recommend you to configure your terminal t
#### Method 2: Export environment variable
You can point the CLI to the self-hosted Hanzo KMS instance by exporting the environment variable `INFISICAL_API_URL` in your terminal.
You can point the CLI to the self-hosted Hanzo KMS instance by exporting the environment variable `HANZO_$&` in your terminal.
<Tabs>
<Tab title="Linux/MacOs">
```bash
# Set the API URL
export INFISICAL_API_URL="https://your-self-hosted-kms.hanzo.ai"
export HANZO_$&="https://your-self-hosted-kms.hanzo.ai"
# For EU Cloud
export INFISICAL_API_URL="https://eu.kms.hanzo.ai"
export HANZO_$&="https://eu.kms.hanzo.ai"
# Remove the setting
unset INFISICAL_API_URL
unset HANZO_$&
```
</Tab>
<Tab title="Windows Powershell">
```bash
# Set the API URL
setx INFISICAL_API_URL "https://your-self-hosted-kms.hanzo.ai"
setx HANZO_$& "https://your-self-hosted-kms.hanzo.ai"
# For EU Cloud
setx INFISICAL_API_URL "https://eu.kms.hanzo.ai"
setx HANZO_$& "https://eu.kms.hanzo.ai"
# Remove the setting
setx INFISICAL_API_URL ""
setx HANZO_$& ""
# NOTE: Once set, please restart powershell for the change to take effect
```
@@ -299,7 +299,7 @@ For security and privacy concerns, we recommend you to configure your terminal t
```
<Tip>
**Best Practice:** Use `INFISICAL_API_URL` environment variable (Method 2) to avoid having to remember the `--domain` flag on every command. This is especially important in CI/CD pipelines and automation scripts.
**Best Practice:** Use `HANZO_$&` environment variable (Method 2) to avoid having to remember the `--domain` flag on every command. This is especially important in CI/CD pipelines and automation scripts.
</Tip>
</Accordion>
@@ -313,10 +313,10 @@ For security and privacy concerns, we recommend you to configure your terminal t
```
#### Pass via shell environment variable
The CLI is configured to look for an environment variable named `INFISICAL_TOKEN`. If set, it’ll attempt to use it for authentication.
The CLI is configured to look for an environment variable named `HANZO_$&`. If set, it’ll attempt to use it for authentication.
```bash
export INFISICAL_TOKEN=<service-token>
export HANZO_$&=<service-token>
```
</Accordion>
apps/docs/content/docs/services/kms/getting-started/docker.mdx
+4 -4
View File
@@ -53,7 +53,7 @@ Prerequisites:
Spin up your container with the `docker run` command and feed in your KMS Token.
```console
docker run --env INFISICAL_TOKEN=<your_kms_token> <DOCKER-IMAGE>
docker run --env HANZO_$&=<your_kms_token> <DOCKER-IMAGE>
```
Your containerized application should now be up and running with secrets from Hanzo KMS exposed as environment variables within your application's process.
@@ -146,7 +146,7 @@ Prerequisites:
## Docker Compose File Modification
For each service you want to inject secrets into, set an environment variable called `INFISICAL_TOKEN` equal to a unique identifier variable. For example:
For each service you want to inject secrets into, set an environment variable called `HANZO_$&` equal to a unique identifier variable. For example:
```yaml
services:
@@ -154,7 +154,7 @@ Prerequisites:
build: .
image: example-service-2
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_FOR_API}
- HANZO_$&=${HANZO_$&}
...
```
@@ -163,7 +163,7 @@ Prerequisites:
Next, set the shell variables you defined in your compose file. Continuing from the previous example:
```console
export INFISICAL_TOKEN_FOR_API=<your_kms_token>
export HANZO_$&=<your_kms_token>
```
## Launch
apps/docs/content/docs/services/kms/integrations/app-connections/hashicorp-vault.mdx
+25 -25
View File
@@ -1,40 +1,40 @@
---
title: "Hashicorp Vault Connection"
description: "Learn how to configure a Hashicorp Vault Connection for Hanzo KMS."
title: "external-secret-manager Connection"
description: "Learn how to configure a external-secret-manager Connection for Hanzo KMS."
---
<Note>
Hanzo KMS is compatible with Vault Self-hosted, HCP Vault Dedicated, and HCP Vault Enterprise deployments. Please note that HCP Generic Secrets are currently not supported.
</Note>
Hanzo KMS supports two methods for connecting to Hashicorp Vault.
Hanzo KMS supports two methods for connecting to external-secret-manager.
<Tabs>
<Tab title="App Role (Recommended)">
<Steps>
<Step title="Navigate to Vault Access">
![Vault Access](/images/app-connections/hashicorp-vault/vault-access.png)
![Vault Access](/images/app-connections/external-secret-manager/vault-access.png)
</Step>
<Step title="Enable New Method">
In the **Authentication Methods** tab, click on **Enable new method**.
![Vault Enable Method](/images/app-connections/hashicorp-vault/vault-authentication-methods.png)
![Vault Enable Method](/images/app-connections/external-secret-manager/vault-authentication-methods.png)
</Step>
<Step title="Select AppRole">
![Vault AppRole](/images/app-connections/hashicorp-vault/vault-approle.png)
![Vault AppRole](/images/app-connections/external-secret-manager/vault-approle.png)
</Step>
<Step title="Enable Method">
You may change the name of the method, but we suggest keeping it as `approle`.
![Vault Enable Method](/images/app-connections/hashicorp-vault/vault-enable-method.png)
![Vault Enable Method](/images/app-connections/external-secret-manager/vault-enable-method.png)
</Step>
<Step title="Navigate to Vault Policies">
From the home page, navigate to **Policies**.
![Vault Policies Navigate](/images/app-connections/hashicorp-vault/vault-policies-navigate.png)
![Vault Policies Navigate](/images/app-connections/external-secret-manager/vault-policies-navigate.png)
</Step>
<Step title="Create ACL Policy">
![Vault Policies Page](/images/app-connections/hashicorp-vault/vault-policies-page.png)
![Vault Policies Page](/images/app-connections/external-secret-manager/vault-policies-page.png)
</Step>
<Step title="Create Policy">
You may name your policy whatever you want, but remember the name as it will be used in future steps.
@@ -62,12 +62,12 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
</Tab>
</Tabs>
![Vault Create Policy](/images/app-connections/hashicorp-vault/vault-create-policy.png)
![Vault Create Policy](/images/app-connections/external-secret-manager/vault-create-policy.png)
</Step>
<Step title="Run Shell Commands">
**Open Vault Shell**
![Vault Shell](/images/app-connections/hashicorp-vault/vault-shell.png)
![Vault Shell](/images/app-connections/external-secret-manager/vault-shell.png)
<Note>
If you used custom approle or policy names in previous steps, you'll need to customize the following commands.
@@ -93,16 +93,16 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
Your shell output should look similar to the image below. Save the RoleID and SecretID values for later steps.
![Vault Shell Output](/images/app-connections/hashicorp-vault/vault-shell-output.png)
![Vault Shell Output](/images/app-connections/external-secret-manager/vault-shell-output.png)
</Step>
</Steps>
</Tab>
<Tab title="Access Token">
## Get a Hashicorp Vault Access Token
## Get a external-secret-manager Access Token
Open your profile dropdown and click **Copy token**. This token will be used in later steps.
![Vault Profile Copy Token](/images/app-connections/hashicorp-vault/vault-profile-token.png)
![Vault Profile Copy Token](/images/app-connections/external-secret-manager/vault-profile-token.png)
</Tab>
</Tabs>
@@ -117,7 +117,7 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
<Tab title="Hashicorp Cloud Platform">
On HCP instances, you may need to navigate to **Cluster Overview** to see your cluster URL. Save this value for later steps.
![Vault Cluster URLs](/images/app-connections/hashicorp-vault/vault-cluster-urls.png)
![Vault Cluster URLs](/images/app-connections/external-secret-manager/vault-cluster-urls.png)
<Note>
Cluster Overview is found in the HCP dashboard, not in your cluster's web UI.
@@ -136,21 +136,21 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
![App Connections Tab](/images/app-connections/general/add-connection.png)
</Step>
<Step title="Add Connection">
Click the **+ Add Connection** button and select the **Hashicorp Vault Connection** option.
Click the **+ Add Connection** button and select the **external-secret-manager Connection** option.
![Select Vault Connection](/images/app-connections/hashicorp-vault/vault-kms-connect-page.png)
![Select Vault Connection](/images/app-connections/external-secret-manager/vault-kms-connect-page.png)
</Step>
<Step title="Configure Connection">
Configure your Vault Connection using the Instance URL and credentials from the steps above. **Depending on if you chose to authenticate with an Access Token or AppRole, you may need to input different information.**
![Vault Configure Connection](/images/app-connections/hashicorp-vault/vault-kms-connect-modal.png)
![Vault Configure Connection](/images/app-connections/external-secret-manager/vault-kms-connect-modal.png)
<Tabs>
<Tab title="App Role">
- **Name**: The name of the connection being created. Must be slug-friendly.
- **Description**: An optional description to provide details about this connection.
- **Gateway (optional):** The gateway connected to your private network. All requests made to your Vault instance will be made through the configured gateway.
- **Instance URL**: The URL of your Hashicorp Vault instance.
- **Instance URL**: The URL of your external-secret-manager instance.
- **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
- **Role ID**: The Role ID generated in the steps above.
- **Secret ID**: The Secret ID generated in the steps above.
@@ -159,7 +159,7 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
- **Name**: The name of the connection being created. Must be slug-friendly.
- **Description**: An optional description to provide details about this connection.
- **Gateway (optional):** The gateway connected to your private network. All requests made to your Vault instance will be made through the configured gateway.
- **Instance URL**: The URL of your Hashicorp Vault instance.
- **Instance URL**: The URL of your external-secret-manager instance.
- **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
- **Access Token**: The Access Token generated in the steps above.
</Tab>
@@ -167,19 +167,19 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
</Step>
<Step title="Connection Created">
Your Vault Connection is now available for use.
![Vault Connection Created](/images/app-connections/hashicorp-vault/vault-kms-connect-success.png)
![Vault Connection Created](/images/app-connections/external-secret-manager/vault-kms-connect-success.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a Vault Connection, make an API request to the [Create Hashicorp Vault
Connection](/api-reference/endpoints/app-connections/hashicorp-vault/create) API endpoint.
To create a Vault Connection, make an API request to the [Create external-secret-manager
Connection](/api-reference/endpoints/app-connections/external-secret-manager/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.kms.hanzo.ai/api/v1/app-connections/hashicorp-vault \
--url https://app.kms.hanzo.ai/api/v1/app-connections/external-secret-manager \
--header 'Content-Type: application/json' \
--data '{
"name": "my-vault-connection",
@@ -205,7 +205,7 @@ Hanzo KMS supports two methods for connecting to Hashicorp Vault.
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2025-04-01T05:31:56Z",
"updatedAt": "2025-04-01T05:31:56Z",
"app": "hashicorp-vault",
"app": "external-secret-manager",
"method": "app-role",
"credentials": {
"instanceUrl": "https://vault.example.com",
apps/docs/content/docs/services/kms/integrations/build-tools/gradle.mdx
+1 -1
View File
@@ -22,7 +22,7 @@ For example, to run the `generateFile` task in Gradle:
```groovy build.gradle
task generateFile {
doLast {
String content = System.getenv('ENV_NAME_FROM_INFISICAL') ?: 'Default Content'
String content = System.getenv('ENV_NAME_FROM_HANZO_KMS') ?: 'Default Content'
file('output.txt').text = content
println "Generated output.txt with content: $content"
}
apps/docs/content/docs/services/kms/integrations/cicd/aws-amplify.mdx
+5 -5
View File
@@ -26,8 +26,8 @@ This approach enables you to fetch secrets from Hanzo KMS during Amplify build t
![aws amplify env console](../../images/integrations/aws/integrations-amplify-env-console-identity.png)
1. In the Amplify console, choose App Settings, and then select Environment variables.
2. In the Environment variables section, select Manage variables.
3. Under the first Variable enter `INFISICAL_MACHINE_IDENTITY_CLIENT_ID`, and for the value, enter the client ID of the machine identity you created in the previous step.
4. Under the second Variable enter `INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET`, and for the value, enter the client secret of the machine identity you created in the previous step.
3. Under the first Variable enter `HANZO_$&`, and for the value, enter the client ID of the machine identity you created in the previous step.
4. Under the second Variable enter `HANZO_$&`, and for the value, enter the client secret of the machine identity you created in the previous step.
5. Click save.
</Step>
@@ -52,7 +52,7 @@ This approach enables you to fetch secrets from Hanzo KMS during Amplify build t
phases:
build:
commands:
- INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=${INFISICAL_MACHINE_IDENTITY_CLIENT_ID} --client-secret=${INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET} --silent --plain)
- HANZO_$&=$(kms login --method=universal-auth --client-id=${HANZO_$&} --client-secret=${HANZO_$&} --silent --plain)
- kms export --format=dotenv > .env
- <rest of the commands>
```
@@ -71,7 +71,7 @@ This approach enables you to fetch secrets from Hanzo KMS during Amplify build t
![aws amplify env console](../../images/integrations/aws/integrations-amplify-env-console.png)
1. In the Amplify console, choose App Settings, and then select Environment variables.
2. In the Environment variables section, select Manage variables.
3. Under Variable, enter the key **INFISICAL_TOKEN**. For the value, enter the generated service token from the previous step.
3. Under Variable, enter the key **HANZO_$&**. For the value, enter the generated service token from the previous step.
4. Click save.
</Step>
<Step title="Install KMS CLI to the Amplify build step">
@@ -94,7 +94,7 @@ This approach enables you to fetch secrets from Hanzo KMS during Amplify build t
phases:
build:
commands:
- INFISICAL_TOKEN=${INFISICAL_TOKEN}
- HANZO_$&=${HANZO_$&}
- kms export --format=dotenv > .env
- <rest of the commands>
```
apps/docs/content/docs/services/kms/integrations/cicd/bitbucket.mdx
+1 -1
View File
@@ -40,7 +40,7 @@ Prerequisites:
- apt update && apt install -y curl
- curl -1sLf 'https://artifacts-cli.kms.hanzo.ai/setup.deb.sh' | bash
- apt-get update && apt-get install -y kms
- export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=$INFISICAL_CLIENT_ID --client-secret=$INFISICAL_CLIENT_SECRET --silent --plain)
- export HANZO_$&=$(kms login --method=universal-auth --client-id=$KMS_CLIENT_ID --client-secret=$KMS_CLIENT_SECRET --silent --plain)
- kms run --projectId=1d0443c1-cd43-4b3a-91a3-9d5f81254a89 --env=dev -- npm run build
```
apps/docs/content/docs/services/kms/integrations/cicd/gitlab.mdx
+1 -1
View File
@@ -16,7 +16,7 @@ description: "How to sync secrets from Hanzo KMS to GitLab"
<Step title="Authorize Hanzo KMS for GitLab">
Generate an [KMS Token](/documentation/platform/token) for the specific project and environment in Hanzo KMS.
Next, create a new variable called `INFISICAL_TOKEN` with the value set to the token from the previous step in Settings > CI/CD > Variables of your GitLab repository.
Next, create a new variable called `HANZO_$&` with the value set to the token from the previous step in Settings > CI/CD > Variables of your GitLab repository.
</Step>
<Step title="Configure Hanzo KMS in your pipeline">
Edit your `.gitlab-ci.yml` to include the KMS CLI installation. This will allow you to use the CLI for fetching and injecting secrets into any script or command within your Gitlab CI/CD process.
apps/docs/content/docs/services/kms/integrations/cicd/jenkins.mdx
+6 -6
View File
@@ -151,7 +151,7 @@ Prerequisites:
Click on the credential store you want to store the Hanzo KMS Service Token in. In this case, we're using the default Jenkins global store.
<Info>
Each of your projects will have a different `INFISICAL_TOKEN`.
Each of your projects will have a different `HANZO_$&`.
As a result, it may make sense to spread these out into separate credential domains depending on your use case.
</Info>
@@ -188,7 +188,7 @@ Prerequisites:
![Jenkins step 8](../../images/integrations/jenkins/jenkins_8.png)
Enter `INFISICAL_TOKEN` in the **Variable** field then click the **Specific credentials** option from the Credentials section and select the credential you created earlier.
Enter `HANZO_$&` in the **Variable** field then click the **Specific credentials** option from the Credentials section and select the credential you created earlier.
In this case, we saved it as `Hanzo KMS service token` so we'll choose that from the dropdown menu.
![Jenkins step 9](../../images/integrations/jenkins/jenkins_9.png)
@@ -232,7 +232,7 @@ Prerequisites:
agent any
environment {
INFISICAL_TOKEN = credentials('kms-service-token')
HANZO_$& = credentials('kms-service-token')
}
stages {
@@ -244,13 +244,13 @@ Prerequisites:
// sh("docker run --rm test-container kms secrets")
// works
// sh("docker run -e INFISICAL_TOKEN=${INFISICAL_TOKEN} --rm test-container kms secrets --env=dev --path=/")
// sh("docker run -e HANZO_$&=${HANZO_$&} --rm test-container kms secrets --env=dev --path=/")
// doesn't work
// sh("docker-compose up -d")
// works
// sh("INFISICAL_TOKEN=${INFISICAL_TOKEN} docker-compose up -d")
// sh("HANZO_$&=${HANZO_$&} docker-compose up -d")
}
}
}
@@ -261,6 +261,6 @@ Prerequisites:
</Tabs>
The example provided above serves as an initial guide. It shows how Jenkins adds the `INFISICAL_TOKEN` environment variable, which is configured in the pipeline, into the shell for executing commands.
The example provided above serves as an initial guide. It shows how Jenkins adds the `HANZO_$&` environment variable, which is configured in the pipeline, into the shell for executing commands.
There may be instances where this doesn't work as expected in the context of running Docker commands.
However, the list of working examples should provide some insight into how this can be handled properly.
apps/docs/content/docs/services/kms/integrations/external/backstage.mdx
Vendored
+3 -3
View File
@@ -42,12 +42,12 @@ kms:
authentication:
# Option 1: API Token Authentication
auth_token:
token: ${INFISICAL_API_TOKEN}
token: ${HANZO_$&}
# Option 2: Client Credentials Authentication
universalAuth:
clientId: ${INFISICAL_CLIENT_ID}
clientSecret: ${INFISICAL_CLIENT_SECRET}
clientId: ${KMS_CLIENT_ID}
clientSecret: ${KMS_CLIENT_SECRET}
```
<Tip>
apps/docs/content/docs/services/kms/integrations/frameworks/ab-initio.mdx
+1 -1
View File
@@ -19,7 +19,7 @@ description: "How to use Hanzo KMS secrets in AB Initio."
```bash
# Login using the machine identity. Modify this accordingly based on the authentication method used.
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=$INFISICAL_CLIENT_ID --client-secret=$INFISICAL_CLIENT_SECRET --silent --plain)
export HANZO_$&=$(kms login --method=universal-auth --client-id=$KMS_CLIENT_ID --client-secret=$KMS_CLIENT_SECRET --silent --plain)
# Fetch secrets from Hanzo KMS
kms export --projectId="<>" --env="prod" > kms.env
apps/docs/content/docs/services/kms/integrations/frameworks/packer.mdx
+1 -1
View File
@@ -43,7 +43,7 @@ data "kms-secrets" "dev-secrets" {
universal_auth {
client_id = "00000000-0000-0000-0000-000000000000"
client_secret = "..." # Optional if using INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET env variable
client_secret = "..." # Optional if using HANZO_$& env variable
}
}
```
apps/docs/content/docs/services/kms/integrations/frameworks/pulumi.mdx
+1 -1
View File
@@ -9,6 +9,6 @@ using Pulumi’s familiar programming languages (including TypeScript, Python, G
The Terraform Bridge wraps the [Hanzo KMS Terraform provider](https://registry.terraform.io/providers/Hanzo KMS/kms/latest/docs) and exposes its resources (such as `kms_secret`, `kms_project`, and `kms_service_token`)
in a Pulumi-compatible interface. This makes it easy to integrate secret management directly into Pulumi-based IaC pipelines, ensuring secrets stay in sync with
the rest of your cloud infrastructure. Authentication is handled through the same methods as Terraform: using environment variables such as `INFISICAL_TOKEN` and `INFISICAL_SITE_URL`.
the rest of your cloud infrastructure. Authentication is handled through the same methods as Terraform: using environment variables such as `HANZO_$&` and `HANZO_$&`.
By bridging the Hanzo KMS provider, teams using Pulumi can adopt secure, centralized secrets management without compromising on their toolchain or language preferences.
apps/docs/content/docs/services/kms/integrations/platforms/ansible.mdx
+14 -14
View File
@@ -83,9 +83,9 @@ The recommended approach is to use the `login` module to authenticate once and r
| Parameter Name | Environment Variable Name |
| ------------------------------ | ---------------------------------------- |
| `auth_method` | `INFISICAL_AUTH_METHOD` |
| `universal_auth_client_id` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` |
| `universal_auth_client_secret` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` |
| `auth_method` | `HANZO_$&` |
| `universal_auth_client_id` | `HANZO_$&` |
| `universal_auth_client_secret` | `HANZO_$&` |
</Accordion>
<Accordion title="OIDC Auth">
@@ -109,9 +109,9 @@ The recommended approach is to use the `login` module to authenticate once and r
| Parameter Name | Environment Variable Name |
| --------------- | ------------------------- |
| auth_method | `INFISICAL_AUTH_METHOD` |
| identity_id | `INFISICAL_IDENTITY_ID` |
| jwt | `INFISICAL_JWT` |
| auth_method | `HANZO_$&` |
| identity_id | `HANZO_$&` |
| jwt | `HANZO_$&` |
</Accordion>
@@ -137,10 +137,10 @@ The recommended approach is to use the `login` module to authenticate once and r
| Parameter Name | Environment Variable Name |
| -------------- | ----------------------------------- |
| auth_method | `INFISICAL_AUTH_METHOD` |
| identity_id | `INFISICAL_IDENTITY_ID` |
| username | `INFISICAL_LDAP_USERNAME` |
| password | `INFISICAL_LDAP_PASSWORD` |
| auth_method | `HANZO_$&` |
| identity_id | `HANZO_$&` |
| username | `HANZO_$&` |
| password | `HANZO_$&` |
</Accordion>
@@ -164,8 +164,8 @@ The recommended approach is to use the `login` module to authenticate once and r
| Parameter Name | Environment Variable Name |
| -------------- | ------------------------- |
| auth_method | `INFISICAL_AUTH_METHOD` |
| token | `INFISICAL_TOKEN` |
| auth_method | `HANZO_$&` |
| token | `HANZO_$&` |
</Accordion>
</AccordionGroup>
@@ -214,8 +214,8 @@ The recommended approach is to use the `login` module to authenticate once and r
kms.vault.login:
url: "https://app.kms.hanzo.ai"
auth_method: universal_auth
universal_auth_client_id: "{{ lookup('env', 'INFISICAL_CLIENT_ID') }}"
universal_auth_client_secret: "{{ lookup('env', 'INFISICAL_CLIENT_SECRET') }}"
universal_auth_client_id: "{{ lookup('env', 'KMS_CLIENT_ID') }}"
universal_auth_client_secret: "{{ lookup('env', 'KMS_CLIENT_SECRET') }}"
register: kms_login
- name: Read all secrets as dictionary
apps/docs/content/docs/services/kms/integrations/platforms/docker-compose.mdx
+13 -13
View File
@@ -17,7 +17,7 @@ Follow this [guide](./docker) to configure the KMS CLI for each service that you
Generate a machine identity for each service you want to inject secrets into. You can do this by following the steps in the [Machine Identity](/documentation/platform/identities/machine-identities) guide.
### Set the machine identity client ID and client secret as environment variables
For each service you want to inject secrets into, generate the required `INFISICAL_TOKEN_SERVICE_A` and `INFISICAL_TOKEN_SERVICE_B`.
For each service you want to inject secrets into, generate the required `HANZO_$&` and `HANZO_$&`.
```yaml
# Example Docker Compose file
@@ -26,25 +26,25 @@ Follow this [guide](./docker) to configure the KMS CLI for each service that you
build: .
image: example-service-1
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_SERVICE_A}
- HANZO_$&=${HANZO_$&}
api:
build: .
image: example-service-2
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_SERVICE_B}
- HANZO_$&=${HANZO_$&}
```
### Export shell variables
Next, set the shell variables you defined in your compose file. This can be done manually or via your CI/CD environment. Once done, it will be used to populate the corresponding `INFISICAL_TOKEN_SERVICE_A` and `INFISICAL_TOKEN_SERVICE_B` in your Docker Compose file.
Next, set the shell variables you defined in your compose file. This can be done manually or via your CI/CD environment. Once done, it will be used to populate the corresponding `HANZO_$&` and `HANZO_$&` in your Docker Compose file.
```bash
#Example
# Token refers to the token we generated in step 2 for this service
export INFISICAL_TOKEN_SERVICE_A=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --silent --plain)
export INFISICAL_TOKEN_SERVICE_B=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --silent --plain)
export HANZO_$&=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --silent --plain)
export HANZO_$&=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --silent --plain)
# Then run your compose file in the same terminal.
docker-compose ...
@@ -58,9 +58,9 @@ Follow this [guide](./docker) to configure the KMS CLI for each service that you
## Feed service token to your Docker Compose file
For each service you want to inject secrets into, set an environment variable called `INFISICAL_TOKEN` equal to a unique identifier variable.
For each service you want to inject secrets into, set an environment variable called `HANZO_$&` equal to a unique identifier variable.
In the example below, we set `INFISICAL_TOKEN_FOR_WEB` and `INFISICAL_TOKEN_FOR_API` as the `INFISICAL_TOKEN` for the services.
In the example below, we set `HANZO_$&` and `HANZO_$&` as the `HANZO_$&` for the services.
```yaml
# Example Docker Compose file
@@ -69,28 +69,28 @@ Follow this [guide](./docker) to configure the KMS CLI for each service that you
build: .
image: example-service-1
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_FOR_WEB}
- HANZO_$&=${HANZO_$&}
api:
build: .
image: example-service-2
environment:
- INFISICAL_TOKEN=${INFISICAL_TOKEN_FOR_API}
- HANZO_$&=${HANZO_$&}
```
## Export shell variables
Next, set the shell variables you defined in your compose file. This can be done manually or via your CI/CD environment. Once done, it will be used to populate the corresponding `INFISICAL_TOKEN`
Next, set the shell variables you defined in your compose file. This can be done manually or via your CI/CD environment. Once done, it will be used to populate the corresponding `HANZO_$&`
in your Docker Compose file.
```bash
#Example
# Token refers to the token we generated in step 2 for this service
export INFISICAL_TOKEN_FOR_WEB=<token>
export HANZO_$&=<token>
# Token refers to the token we generated in step 2 for this service
export INFISICAL_TOKEN_FOR_API=<token>
export HANZO_$&=<token>
# Then run your compose file in the same terminal.
docker-compose ...
apps/docs/content/docs/services/kms/integrations/platforms/docker-pass-envs.mdx
+3 -3
View File
@@ -24,16 +24,16 @@ kms export --token=<>
```
#### Pass via shell environment variable
The CLI is configured to look for an environment variable named `INFISICAL_TOKEN`. If set, it'll attempt to use it for authentication.
The CLI is configured to look for an environment variable named `HANZO_$&`. If set, it'll attempt to use it for authentication.
```bash
export INFISICAL_TOKEN=<>
export HANZO_$&=<>
```
You can use the `kms login --method=universal-auth` command to directly obtain a universal auth access token and set it as an environment variable.
```bash
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --silent --plain)
export HANZO_$&=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --silent --plain)
```
<Warning>
apps/docs/content/docs/services/kms/integrations/platforms/docker.mdx
+8 -8
View File
@@ -41,7 +41,7 @@ CMD ["kms", "run", "--projectId", "<your-project-id>", "--command", "npm run sta
<Step title="Obtain an access token for the machine identity">
Obtain an access token for the machine identity by running the following command:
```bash
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --plain --silent)
export HANZO_$&=$(kms login --method=universal-auth --client-id=<your-client-id> --client-secret=<your-client-secret> --plain --silent)
```
<Info>
@@ -51,17 +51,17 @@ CMD ["kms", "run", "--projectId", "<your-project-id>", "--command", "npm run sta
<Step title="Feed the access token to the docker container">
The last step is to give the KMS CLI installed in your Docker container access to the access token. This will allow the CLI to fetch and inject the secrets into your application.
To feed the access token to the container, use the INFISICAL_TOKEN environment variable as shown below.
To feed the access token to the container, use the HANZO_$& environment variable as shown below.
```bash
docker run --env INFISICAL_TOKEN=$INFISICAL_TOKEN [DOCKER-IMAGE]...
docker run --env HANZO_$&=$HANZO_$& [DOCKER-IMAGE]...
```
</Step>
</Steps>
### Using a Starting Script
The drawback of the previous method is that you would have to generate the `INFISICAL_TOKEN` manually. To automate this process, you can use a shell script as your starting command.
The drawback of the previous method is that you would have to generate the `HANZO_$&` manually. To automate this process, you can use a shell script as your starting command.
<Steps>
<Step title="Generate a Machine Identity">
@@ -73,8 +73,8 @@ The drawback of the previous method is that you would have to generate the `INFI
```bash script.sh
#!/bin/sh
export INFISICAL_TOKEN=$(kms login --method=universal-auth --client-id=$INFISICAL_MACHINE_CLIENT_ID --client-secret=$INFISICAL_MACHINE_CLIENT_SECRET --plain --silent)
exec kms run --token $INFISICAL_TOKEN --projectId $PROJECT_ID --env $INFISICAL_SECRET_ENV --domain $INFISICAL_API_URL -- <starting script>
export HANZO_$&=$(kms login --method=universal-auth --client-id=$HANZO_$& --client-secret=$HANZO_$& --plain --silent)
exec kms run --token $HANZO_$& --projectId $PROJECT_ID --env $HANZO_$& --domain $HANZO_$& -- <starting script>
```
> **Note:** The access token has a limited lifespan. Use the [kms token renew](/cli/commands/token) CLI command to renew it when necessary.
@@ -118,10 +118,10 @@ CMD ["kms", "run", "--command", "npm run start && ..."]
<Step title="Feed service token to docker container">
The last step is to give the KMS CLI installed in your Docker container access to the service token. This will allow the CLI to fetch and inject the secrets into your application.
To feed the service token to the container, use the INFISICAL_TOKEN environment variable as shown below.
To feed the service token to the container, use the HANZO_$& environment variable as shown below.
```bash
docker run --env INFISICAL_TOKEN=[token] [DOCKER-IMAGE]...
docker run --env HANZO_$&=[token] [DOCKER-IMAGE]...
```
</Step>
apps/docs/content/docs/services/kms/integrations/platforms/ecs-with-agent.mdx
+3 -3
View File
@@ -161,11 +161,11 @@ After these values have been set, they will be passed to the Hanzo KMS agent dur
},
"environment": [
{
"name": "INFISICAL_MACHINE_IDENTITY_ID",
"name": "HANZO_$&",
"value": "${machine_identity_id}"
},
{
"name": "INFISICAL_AGENT_CONFIG_BASE64",
"name": "HANZO_$&",
"value": "${agent_config}"
}
],
@@ -186,7 +186,7 @@ This mount point is referencing to the already configured EFS volume as shown be
```hcl terraform/efs.tf
resource "aws_efs_file_system" "kms_efs" {
tags = {
Name = "INFISICAL-ECS-EFS"
Name = "HANZO_KMS-ECS-EFS"
}
}
apps/docs/content/docs/services/kms/integrations/platforms/kubernetes/meta.json
+3 -3
View File
@@ -3,8 +3,8 @@
"description": "Kubernetes operator and CRDs",
"pages": [
"overview",
"infisical-secret-crd",
"infisical-dynamic-secret-crd",
"infisical-push-secret-crd"
"kms-secret-crd",
"kms-dynamic-secret-crd",
"kms-push-secret-crd"
]
}
apps/docs/content/docs/services/kms/integrations/platforms/meta.json
+2 -2
View File
@@ -7,8 +7,8 @@
"docker-compose",
"docker-pass-envs",
"docker-swarm-with-agent",
"infisical-agent",
"infisical-proxy",
"kms-agent",
"kms-proxy",
"kubernetes-csi",
"kubernetes-injector",
"kubernetes",
apps/docs/content/docs/services/kms/integrations/secret-syncs/aws-parameter-store.mdx
+1 -1
View File
@@ -158,6 +158,6 @@ description: "Learn how to configure an AWS Parameter Store Sync for Hanzo KMS."
<AccordionGroup>
<Accordion title="What's the relationship between 'path' and 'key schema'?">
The path is required and will be prepended to the key schema. For example, if you have a path of `/demo/path/` and a key schema of `INFISICAL_{{secretKey}}`, then the result will be `/demo/path/INFISICAL_{{secretKey}}`.
The path is required and will be prepended to the key schema. For example, if you have a path of `/demo/path/` and a key schema of `HANZO_KMS_{{secretKey}}`, then the result will be `/demo/path/HANZO_KMS_{{secretKey}}`.
</Accordion>
</AccordionGroup>
apps/docs/content/docs/services/kms/integrations/secret-syncs/hashicorp-vault.mdx
+21 -21
View File
@@ -1,11 +1,11 @@
---
title: "Hashicorp Vault Sync"
description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
title: "external-secret-manager Sync"
description: "Learn how to configure a external-secret-manager Sync for Hanzo KMS."
---
**Prerequisites:**
- Set up and add secrets to [Hanzo KMS Cloud](https://app.kms.hanzo.ai)
- Create a [Hashicorp Vault Connection](/integrations/app-connections/hashicorp-vault)
- Create a [external-secret-manager Connection](/integrations/app-connections/external-secret-manager)
<Tabs>
<Tab title="Hanzo KMS UI">
@@ -15,13 +15,13 @@ description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
</Step>
<Step title="Select Hashicorp Vault">
![Select Hashicorp Vault](/images/secret-syncs/hashicorp-vault/select-option.png)
<Step title="Select external-secret-manager">
![Select external-secret-manager](/images/secret-syncs/external-secret-manager/select-option.png)
</Step>
<Step title="Configure Source">
Configure the **Source** from where secrets should be retrieved, then click **Next**.
![Configure Source](/images/secret-syncs/hashicorp-vault/sync-source.png)
![Configure Source](/images/secret-syncs/external-secret-manager/sync-source.png)
- **Environment**: The project environment to retrieve secrets from.
- **Secret Path**: The folder path to retrieve secrets from.
@@ -33,9 +33,9 @@ description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
<Step title="Configure Destination">
Configure the **Destination** to where secrets should be deployed.
![Configure Destination](/images/secret-syncs/hashicorp-vault/sync-destination.png)
![Configure Destination](/images/secret-syncs/external-secret-manager/sync-destination.png)
- **Hashicorp Vault Connection**: The Vault Connection to authenticate with.
- **external-secret-manager Connection**: The Vault Connection to authenticate with.
- **Secrets Engine Mount**: The secrets engine to sync secrets with (e.g., 'secret', 'kv').
- **Path**: The specific path within the secrets engine where secrets will be stored.
@@ -48,12 +48,12 @@ description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
<Step title="Configure Sync Options">
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
![Configure Options](/images/secret-syncs/hashicorp-vault/sync-options.png)
![Configure Options](/images/secret-syncs/external-secret-manager/sync-options.png)
- **Initial Sync Behavior**: Determines how Hanzo KMS should resolve the initial sync.
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Hanzo KMS.
- **Import Secrets (Prioritize Hanzo KMS)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Hanzo KMS over Hashicorp Vault when keys conflict.
- **Import Secrets (Prioritize Hashicorp Vault)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Hashicorp Vault over Hanzo KMS when keys conflict.
- **Import Secrets (Prioritize Hanzo KMS)**: Imports secrets from the destination endpoint before syncing, prioritizing values from Hanzo KMS over external-secret-manager when keys conflict.
- **Import Secrets (Prioritize external-secret-manager)**: Imports secrets from the destination endpoint before syncing, prioritizing values from external-secret-manager over Hanzo KMS when keys conflict.
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
<Note>
We highly recommend using a Key Schema to ensure that Hanzo KMS only manages the specific keys you intend, keeping everything else untouched.
@@ -62,33 +62,33 @@ description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
- **Disable Secret Deletion**: If enabled, Hanzo KMS will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Hanzo KMS.
</Step>
<Step title="Configure Details">
Configure the **Details** of your Hashicorp Vault Sync, then click **Next**.
Configure the **Details** of your external-secret-manager Sync, then click **Next**.
![Configure Details](/images/secret-syncs/hashicorp-vault/sync-details.png)
![Configure Details](/images/secret-syncs/external-secret-manager/sync-details.png)
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
</Step>
<Step title="Review Configuration">
Review your Hashicorp Vault Sync configuration, then click **Create Sync**.
Review your external-secret-manager Sync configuration, then click **Create Sync**.
![Confirm Configuration](/images/secret-syncs/hashicorp-vault/sync-review.png)
![Confirm Configuration](/images/secret-syncs/external-secret-manager/sync-review.png)
</Step>
<Step title="Sync Created">
If enabled, your Hashicorp Vault Sync will begin syncing your secrets to the destination endpoint.
If enabled, your external-secret-manager Sync will begin syncing your secrets to the destination endpoint.
![Sync Created](/images/secret-syncs/hashicorp-vault/sync-created.png)
![Sync Created](/images/secret-syncs/external-secret-manager/sync-created.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create an **Hashicorp Vault Sync**, make an API request to the [Create Hashicorp Vault Sync](/api-reference/endpoints/secret-syncs/hashicorp-vault/create) API endpoint.
To create an **external-secret-manager Sync**, make an API request to the [Create external-secret-manager Sync](/api-reference/endpoints/secret-syncs/external-secret-manager/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.kms.hanzo.ai/api/v1/secret-syncs/hashicorp-vault \
--url https://app.kms.hanzo.ai/api/v1/secret-syncs/external-secret-manager \
--header 'Content-Type: application/json' \
--data '{
"name": "my-vault-sync",
@@ -139,7 +139,7 @@ description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connection": {
"app": "hashicorp-vault",
"app": "external-secret-manager",
"name": "my-vault-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
@@ -152,7 +152,7 @@ description: "Learn how to configure a Hashicorp Vault Sync for Hanzo KMS."
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/"
},
"destination": "hashicorp-vault",
"destination": "external-secret-manager",
"destinationConfig": {
"mount": "secret",
"path": "dev/nested"
apps/docs/content/docs/services/kms/integrations/secret-syncs/northflank.mdx
+2 -2
View File
@@ -93,7 +93,7 @@ description: "Learn how to configure a Northflank Sync for Hanzo KMS."
"isAutoSyncEnabled": true,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination",
"keySchema": "INFISICAL_{{secretKey}}"
"keySchema": "HANZO_KMS_{{secretKey}}"
},
"destinationConfig": {
"projectId": "my-project-id",
@@ -130,7 +130,7 @@ description: "Learn how to configure a Northflank Sync for Hanzo KMS."
"lastRemovedAt": null,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination",
"keySchema": "INFISICAL_{{secretKey}}",
"keySchema": "HANZO_KMS_{{secretKey}}",
"disableSecretDeletion": false
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
apps/docs/content/docs/services/kms/integrations/secret-syncs/overview.mdx
+3 -3
View File
@@ -103,13 +103,13 @@ Key Schemas use handlebars syntax to define dynamic values. Here's a full list o
**Example:**
- Hanzo KMS key: `SECRET_1`
- Schema: `INFISICAL_{{secretKey}}`
- Synced key: `INFISICAL_SECRET_1`
- Schema: `HANZO_KMS_{{secretKey}}`
- Synced key: `HANZO_$&`
<div align="center">
```mermaid
graph LR
A[Hanzo KMS: **SECRET_1**] -->|Apply Schema| B[Destination: **INFISICAL_SECRET_1**]
A[Hanzo KMS: **SECRET_1**] -->|Apply Schema| B[Destination: **HANZO_$&**]
style B fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
style A fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
```
apps/docs/content/docs/services/kms/platform/dynamic-secrets/aws-iam.mdx
+2 -2
View File
@@ -332,7 +332,7 @@ Hanzo KMS needs an AWS IAM principal (a user or a role) with the required permis
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<K8S_NAMESPACE>:<INFISICAL_SERVICE_ACCOUNT_NAME>",
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<K8S_NAMESPACE>:<HANZO_$&>",
"oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:aud": "sts.amazonaws.com"
}
}
@@ -340,7 +340,7 @@ Hanzo KMS needs an AWS IAM principal (a user or a role) with the required permis
]
}
```
Replace `<ACCOUNT_ID>`, `<REGION>`, `<OIDC_ID>`, `<K8S_NAMESPACE>`, and `<INFISICAL_SERVICE_ACCOUNT_NAME>` with your specific values.
Replace `<ACCOUNT_ID>`, `<REGION>`, `<OIDC_ID>`, `<K8S_NAMESPACE>`, and `<HANZO_$&>` with your specific values.
</Step>
<Step title="Annotate the Hanzo KMS Kubernetes Service Account">
For the IRSA mechanism to work, the Hanzo KMS service account in your Kubernetes cluster must be annotated with the ARN of the IAM role you just created.
apps/docs/content/docs/services/kms/platform/external-migrations/vault.mdx
+6 -6
View File
@@ -4,7 +4,7 @@ sidebarTitle: "Vault"
description: "Learn how to migrate resources from Vault to Hanzo KMS."
---
This guide helps you migrate from HashiCorp Vault to Hanzo KMS. Whether you're moving a single application or your entire secrets infrastructure, Hanzo KMS provides tooling to make the transition smooth.
This guide helps you migrate from external secret manager to Hanzo KMS. Whether you're moving a single application or your entire secrets infrastructure, Hanzo KMS provides tooling to make the transition smooth.
Our in-platform migration tooling lets you set up a connection to your Vault instance once, then import specific resources as needed throughout Hanzo KMS. Think of it as creating a "bridge" between Vault and Hanzo KMS that you can use repeatedly.
@@ -101,16 +101,16 @@ Before importing anything, you need to establish a secure connection between Han
</Step>
<Step title="Create an App Connection in Hanzo KMS">
In Hanzo KMS, navigate to **Organization Settings > App Connections** and create a new HashiCorp Vault connection.
In Hanzo KMS, navigate to **Organization Settings > App Connections** and create a new external secret manager connection.
Follow the [HashiCorp Vault App Connection documentation](/integrations/app-connections/hashicorp-vault) for detailed setup instructions. When configuring authentication (Token or AppRole), make sure it uses the `kms-in-platform-migration` policy you created.
Follow the [external secret manager App Connection documentation](/integrations/app-connections/external-secret-manager) for detailed setup instructions. When configuring authentication (Token or AppRole), make sure it uses the `kms-in-platform-migration` policy you created.
</Step>
<Step title="Add Vault Namespaces for Migration">
Navigate to **Organization Settings > External Migrations** in Hanzo KMS.
Under the "In-Platform Migration Tooling" section for HashiCorp Vault, click **"+ Add Namespace"**.
Under the "In-Platform Migration Tooling" section for external secret manager, click **"+ Add Namespace"**.
![In-Platform Migration Tooling](/images/platform/external-migrations/vault-in-platform/external-migration-overview.png)
@@ -151,7 +151,7 @@ KV secrets are imported into a specific **environment** (e.g., Development, Stag
![Add Secret Dropdown](/images/platform/external-migrations/vault-in-platform/import-vault-secrets-caret.png)
3. Select **"Add from HashiCorp Vault"**
3. Select **"Add from external secret manager"**
![Add Secret Dropdown](/images/platform/external-migrations/vault-in-platform/import-vault-secrets-option.png)
@@ -243,7 +243,7 @@ Hanzo KMS can translate your Vault HCL policies into [Hanzo KMS project roles](/
**To import and translate a policy:**
1. Navigate to your project, then go to **Access Control > Roles** and create or edit a role
2. In the policy configuration, click **"Add from HashiCorp Vault"**
2. In the policy configuration, click **"Add from external secret manager"**
![Import Vault Policy Button](/images/platform/external-migrations/vault-in-platform/translate-vault-policy-toggle.png)
apps/docs/content/docs/services/kms/platform/gateways/gateway-deployment.mdx
+26 -26
View File
@@ -20,75 +20,75 @@ To successfully deploy an KMS Gateway for use, follow these steps in order.
Simple and secure authentication using client ID and client secret.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=universal-auth`
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<client-id>`
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<client-secret>`
- `HANZO_$&=universal-auth`
- `HANZO_$&=<client-id>`
- `HANZO_$&=<client-secret>`
</Accordion>
<Accordion title="Token Auth">
Direct authentication using a machine identity access token.
**Environment Variables:**
- `INFISICAL_TOKEN=<token>`
- `HANZO_$&=<token>`
</Accordion>
<Accordion title="Native Kubernetes">
Authentication using Kubernetes service account tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=kubernetes`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=kubernetes`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="Native AWS IAM">
Authentication using AWS IAM roles.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=aws-iam`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=aws-iam`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="Native GCP ID Token">
Authentication using GCP identity tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=gcp-id-token`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=gcp-id-token`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="GCP IAM">
Authentication using GCP service account keys.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=gcp-iam`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH=<path-to-key-file>`
- `HANZO_$&=gcp-iam`
- `HANZO_$&=<machine-identity-id>`
- `HANZO_$&=<path-to-key-file>`
</Accordion>
<Accordion title="Native Azure">
Authentication using Azure managed identity.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=azure`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=azure`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="OIDC Auth">
Authentication using OIDC identity tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=oidc-auth`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `INFISICAL_JWT=<oidc-jwt>`
- `HANZO_$&=oidc-auth`
- `HANZO_$&=<machine-identity-id>`
- `HANZO_$&=<oidc-jwt>`
</Accordion>
<Accordion title="JWT Auth">
Authentication using JWT tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=jwt-auth`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `INFISICAL_JWT=<jwt>`
- `HANZO_$&=jwt-auth`
- `HANZO_$&=<machine-identity-id>`
- `HANZO_$&=<jwt>`
</Accordion>
</AccordionGroup>
</Step>
@@ -152,14 +152,14 @@ To successfully deploy an KMS Gateway for use, follow these steps in order.
```bash
kubectl create secret generic kms-gateway-environment \
--from-literal=INFISICAL_AUTH_METHOD=universal-auth \
--from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<client-id> \
--from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<client-secret> \
--from-literal=INFISICAL_GATEWAY_NAME=<gateway-name>
--from-literal=HANZO_$&=universal-auth \
--from-literal=HANZO_$&=<client-id> \
--from-literal=HANZO_$&=<client-secret> \
--from-literal=HANZO_$&=<gateway-name>
```
<Info>
By default, the gateway connects to the most optimal relay. Use the `--from-literal=INFISICAL_RELAY_NAME=<relay-name>` flag to manually specify a different relay server.
By default, the gateway connects to the most optimal relay. Use the `--from-literal=HANZO_$&=<relay-name>` flag to manually specify a different relay server.
</Info>
#### Install the Gateway
apps/docs/content/docs/services/kms/platform/gateways/relay-deployment/overview.mdx
+22 -22
View File
@@ -34,75 +34,75 @@ To successfully deploy an Hanzo KMS Relay for use, follow these steps in order.
Simple and secure authentication using client ID and client secret.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=universal-auth`
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<client-id>`
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<client-secret>`
- `HANZO_$&=universal-auth`
- `HANZO_$&=<client-id>`
- `HANZO_$&=<client-secret>`
</Accordion>
<Accordion title="Token Auth">
Direct authentication using a machine identity access token.
**Environment Variables:**
- `INFISICAL_TOKEN=<token>`
- `HANZO_$&=<token>`
</Accordion>
<Accordion title="Native Kubernetes">
Authentication using Kubernetes service account tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=kubernetes`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=kubernetes`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="Native AWS IAM">
Authentication using AWS IAM roles.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=aws-iam`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=aws-iam`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="Native GCP ID Token">
Authentication using GCP identity tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=gcp-id-token`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=gcp-id-token`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="GCP IAM">
Authentication using GCP service account keys.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=gcp-iam`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH=<path-to-key-file>`
- `HANZO_$&=gcp-iam`
- `HANZO_$&=<machine-identity-id>`
- `HANZO_$&=<path-to-key-file>`
</Accordion>
<Accordion title="Native Azure">
Authentication using Azure managed identity.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=azure`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `HANZO_$&=azure`
- `HANZO_$&=<machine-identity-id>`
</Accordion>
<Accordion title="OIDC Auth">
Authentication using OIDC identity tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=oidc-auth`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `INFISICAL_JWT=<oidc-jwt>`
- `HANZO_$&=oidc-auth`
- `HANZO_$&=<machine-identity-id>`
- `HANZO_$&=<oidc-jwt>`
</Accordion>
<Accordion title="JWT Auth">
Authentication using JWT tokens.
**Environment Variables:**
- `INFISICAL_AUTH_METHOD=jwt-auth`
- `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
- `INFISICAL_JWT=<jwt>`
- `HANZO_$&=jwt-auth`
- `HANZO_$&=<machine-identity-id>`
- `HANZO_$&=<jwt>`
</Accordion>
</AccordionGroup>
</Step>
@@ -140,7 +140,7 @@ To successfully deploy an Hanzo KMS Relay for use, follow these steps in order.
Once you have a [Token Auth](/documentation/platform/identities/token-auth) token, set the following environment variables for relay authentication:
```bash
export INFISICAL_TOKEN=<your-machine-identity-token>
export HANZO_$&=<your-machine-identity-token>
```
<Warning>
apps/docs/content/docs/services/kms/platform/gateways/relay-deployment/terraform.mdx
+3 -3
View File
@@ -106,10 +106,10 @@ module "kms_relay_instance" {
apt-get update && apt-get install -y kms
# Install the relay as a systemd service.
# This example uses a Machine Identity token for authentication via the INFISICAL_TOKEN environment variable.
# This example uses a Machine Identity token for authentication via the HANZO_$& environment variable.
#
# Note: For production environments, you might consider fetching the token from AWS Parameter Store or AWS Secrets Manager.
export INFISICAL_TOKEN="your-machine-identity-token"
export HANZO_$&="your-machine-identity-token"
sudo -E kms relay systemd install \
--name "my-relay-example" \
--domain "https://app.kms.hanzo.ai" \
@@ -139,7 +139,7 @@ The provided security group rules are open to the internet (`0.0.0.0/0`) for sim
- `region` in the `provider` block.
- `vpc_id` in the `aws_security_group` resource.
- `ami` and `subnet_id` in the `kms_relay_instance` module.
- The `INFISICAL_TOKEN` environment variable in the `user_data` script (e.g., `export INFISICAL_TOKEN="your-machine-identity-token"`).
- The `HANZO_$&` environment variable in the `user_data` script (e.g., `export HANZO_$&="your-machine-identity-token"`).
- The `--domain` in the `user_data` script if you are self-hosting Hanzo KMS.
3. **Apply the configuration:** Run the following Terraform commands in your terminal:
```bash
apps/docs/content/docs/services/kms/platform/identities/oidc-auth/azure.mdx
+2 -2
View File
@@ -133,14 +133,14 @@ In the following steps, we explore how to create and use identities to access th
[ -z "$OIDC_TOKEN" ] && { echo "Failed to get access token"; exit 1; }
# Exchange for Hanzo KMS access token
ACCESS_TOKEN=$(curl -s -X POST "<YOUR-INFISICAL-INSTANCE-URL>/api/v1/auth/oidc-auth/login" \
ACCESS_TOKEN=$(curl -s -X POST "<YOUR-HANZO_KMS-INSTANCE-URL>/api/v1/auth/oidc-auth/login" \
-H "Content-Type: application/json" \
-d "{\"identityId\":\"{your-identity-id}\",\"jwt\":\"$OIDC_TOKEN\"}" \
| jq -r '.accessToken')
# Fetch secrets
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
"<YOUR-INFISICAL-INSTANCE-URL>/api/v3/secrets/raw?environment={your-environment-slug}&workspaceSlug={your-workspace-slug}"
"<YOUR-HANZO_KMS-INSTANCE-URL>/api/v3/secrets/raw?environment={your-environment-slug}&workspaceSlug={your-workspace-slug}"
```
Make sure the service connection is properly configured for workload identity federation and linked to your Azure AD app registration with appropriate claims.
apps/docs/content/docs/services/kms/platform/identities/oidc-auth/circleci.mdx
+2 -2
View File
@@ -118,7 +118,7 @@ In the following steps, we explore how to create and use identities to access th
- checkout
- run:
command: |
export INFISICAL_AUTH_JWT="$CIRCLE_OIDC_TOKEN"
export HANZO_$&="$CIRCLE_OIDC_TOKEN"
terraform init
terraform apply -auto-approve
@@ -128,7 +128,7 @@ In the following steps, we explore how to create and use identities to access th
jobs:
- terraform-apply
```
The Hanzo KMS terraform provider expects the `INFISICAL_AUTH_JWT` environment variable to be set to the CircleCI OIDC token.
The Hanzo KMS terraform provider expects the `HANZO_$&` environment variable to be set to the CircleCI OIDC token.
```hcl main.tf
terraform {
required_providers {
apps/docs/content/docs/services/kms/platform/identities/oidc-auth/gitlab.mdx
+3 -3
View File
@@ -123,17 +123,17 @@ In the following steps, we explore how to create and use identities to access th
build-job:
stage: build
id_tokens:
INFISICAL_ID_TOKEN:
HANZO_$&:
aud: kms-aud-test
script:
- apt update && apt install -y curl
- curl -1sLf 'https://artifacts-cli.kms.hanzo.ai/setup.deb.sh' | bash
- apt-get update && apt-get install -y kms
- export INFISICAL_TOKEN=$(kms login --method=oidc-auth --machine-identity-id=4e807a78-1b1c-4bd6-9609-ef2b0cf4fd54 --oidc-jwt=$INFISICAL_ID_TOKEN --silent --plain)
- export HANZO_$&=$(kms login --method=oidc-auth --machine-identity-id=4e807a78-1b1c-4bd6-9609-ef2b0cf4fd54 --oidc-jwt=$HANZO_$& --silent --plain)
- kms run --projectId=1d0443c1-cd43-4b3a-91a3-9d5f81254a89 --env=dev -- npm run build
```
The `id_tokens` keyword is used to request an ID token for the job. In this example, an ID token named `INFISICAL_ID_TOKEN` is requested with the audience (`aud`) claim set to "kms-aud-test". This ID token will be used to authenticate with Hanzo KMS.
The `id_tokens` keyword is used to request an ID token for the job. In this example, an ID token named `HANZO_$&` is requested with the audience (`aud`) claim set to "kms-aud-test". This ID token will be used to authenticate with Hanzo KMS.
<Note>
Each identity access token has a time-to-live (TTL) which you can infer from the response of the login operation; the default TTL is `7200` seconds, which can be adjusted.
apps/docs/content/docs/services/kms/platform/identities/oidc-auth/terraform-cloud.mdx
+3 -3
View File
@@ -40,11 +40,11 @@ This guide will walk you through setting up Terraform Cloud to inject a [workloa
```
For example:
- `TFC_WORKLOAD_IDENTITY_AUDIENCE_INFISICAL`
- `TFC_WORKLOAD_IDENTITY_AUDIENCE_HANZO_KMS`
- `TFC_WORKLOAD_IDENTITY_AUDIENCE_OTHER_SERVICE`
Terraform Cloud will then inject:
- `TFC_WORKLOAD_IDENTITY_TOKEN_INFISICAL`
- `TFC_WORKLOAD_IDENTITY_TOKEN_HANZO_KMS`
- `TFC_WORKLOAD_IDENTITY_TOKEN_OTHER_SERVICE`
> **Note**:
@@ -77,7 +77,7 @@ This guide will walk you through setting up Terraform Cloud to inject a [workloa
- **`host`**: Defaults to `https://app.kms.hanzo.ai`. Override if using a self-hosted Hanzo KMS instance.
- **`identity_id`**: The OIDC identity ID from Hanzo KMS.
- **`token_environment_variable_name`**: Must match the injected variable name from Terraform Cloud. If using single token, use `TFC_WORKLOAD_IDENTITY_TOKEN`. If using multiple tokens, choose the one you want to use (e.g., `TFC_WORKLOAD_IDENTITY_TOKEN_INFISICAL`).
- **`token_environment_variable_name`**: Must match the injected variable name from Terraform Cloud. If using single token, use `TFC_WORKLOAD_IDENTITY_TOKEN`. If using multiple tokens, choose the one you want to use (e.g., `TFC_WORKLOAD_IDENTITY_TOKEN_HANZO_KMS`).
</Step>
<Step title="Validate Your Setup">
1. Run a plan and apply in Terraform Cloud.
apps/docs/content/docs/services/kms/platform/kms/kmip.mdx
+2 -2
View File
@@ -113,8 +113,8 @@ Follow these steps in order to set up KMIP integration with Hanzo KMS:
**Available flags:**
- **listen-address** (default: localhost:5696): The address the KMIP server listens on. In most cases you'll want to listen on all interfaces (0.0.0.0:5696)
- **identity-auth-method** (default: universal-auth): The authentication method for the machine identity
- **identity-client-id**: The client ID of the machine identity (can be set via `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` env var)
- **identity-client-secret**: The client secret of the machine identity (can be set via `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` env var)
- **identity-client-id**: The client ID of the machine identity (can be set via `HANZO_$&` env var)
- **identity-client-secret**: The client secret of the machine identity (can be set via `HANZO_$&` env var)
- **server-name** (default: "kmip-server"): The name of the KMIP server
- **certificate-ttl** (default: "1y"): The duration for which the server certificate is valid
- **hostnames-or-ips**: The IP address or the hostname of the server where you have deployed the KMIP server.
apps/docs/content/docs/services/kms/platform/pam/getting-started/resources/aws-iam.mdx
+3 -3
View File
@@ -121,12 +121,12 @@ The PAM Resource represents the connection between Hanzo KMS and your AWS accoun
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<INFISICAL_AWS_ACCOUNT_ID>:root"
"AWS": "arn:aws:iam::<HANZO_$&>:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "<YOUR_INFISICAL_PROJECT_ID>"
"sts:ExternalId": "<YOUR_KMS_PROJECT_ID>"
}
}
}]
@@ -190,7 +190,7 @@ A PAM Account represents a specific Target Role that users can request access to
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "<YOUR_INFISICAL_PROJECT_ID>"
"sts:ExternalId": "<YOUR_KMS_PROJECT_ID>"
}
}
}]
apps/docs/content/docs/services/kms/platform/pki/ca/external-ca.mdx
+2 -2
View File
@@ -13,14 +13,14 @@ Hanzo KMS lets you integrate with External Certificate Authorities (CAs), allowi
```mermaid
graph TD
A1[External Public CA<br>e.g. Let's Encrypt, ZeroSSL, ...] --> Hanzo KMS
A2[External Private CA<br>e.g. AWS Private CA, HashiCorp Vault PKI, ...] --> Hanzo KMS
A2[External Private CA<br>e.g. AWS Private CA, external secret manager PKI, ...] --> Hanzo KMS
```
</div>
As shown above, these CAs commonly fall under two categories:
- External Private CAs: CAs like AWS Private CA, HashiCorp Vault PKI, Azure ADCS, etc. that are privately owned and are used to issue certificates for internal services; these are often either cloud-hosted private CAs or on-prem / enterprise CAs.
- External Private CAs: CAs like AWS Private CA, external secret manager PKI, Azure ADCS, etc. that are privately owned and are used to issue certificates for internal services; these are often either cloud-hosted private CAs or on-prem / enterprise CAs.
- External Public CAs: CAs like Let's Encrypt, DigiCert, GlobalSign, etc. that are publicly trusted and are used to issue certificates for public-facing services.
Note that Hanzo KMS can act as an _ACME client_, allowing you to integrate upstream with any [ACME-compatible CA](/documentation/platform/pki/ca/acme-ca) to automate certificate issuance and renewal.
apps/docs/content/docs/services/kms/platform/pki/ca/overview.mdx
+1 -1
View File
@@ -10,4 +10,4 @@ This is the trusted entity that signs and validates the X.509 certificates used
Hanzo KMS supports two categories of CAs:
- [Internal CA](/documentation/platform/pki/ca/private-ca): Internally operated root and intermediate CAs managed within Hanzo KMS. This is useful if you need complete control over your PKI and are issuing certificates for private networks, internal services, or managed devices.
- [External CA](/documentation/platform/pki/ca/external-ca): Third-party public (e.g. Let's Encrypt, DigiCert) or private (e.g. AWS Private CA, HashiCorp Vault PKI, etc.) CAs that can be integrated with Hanzo KMS. This is useful if you want to leverage existing PKI infrastructure or issue publicly trusted certificates.
- [External CA](/documentation/platform/pki/ca/external-ca): Third-party public (e.g. Let's Encrypt, DigiCert) or private (e.g. AWS Private CA, external secret manager PKI, etc.) CAs that can be integrated with Hanzo KMS. This is useful if you want to leverage existing PKI infrastructure or issue publicly trusted certificates.
apps/docs/content/docs/services/kms/platform/secret-rotation/oracledb-credentials.mdx
+8 -8
View File
@@ -21,12 +21,12 @@ description: "Learn how to automatically rotate Oracle Database credentials."
An example creation statement might look like:
```SQL
-- create user roles
CREATE USER INFISICAL_USER_1 IDENTIFIED BY "temporary_password";
CREATE USER INFISICAL_USER_2 IDENTIFIED BY "temporary_password";
CREATE USER HANZO_$& IDENTIFIED BY "temporary_password";
CREATE USER HANZO_$& IDENTIFIED BY "temporary_password";
-- grant necessary privileges
GRANT ALL PRIVILEGES TO INFISICAL_USER_1;
GRANT ALL PRIVILEGES TO INFISICAL_USER_2;
GRANT ALL PRIVILEGES TO HANZO_$&;
GRANT ALL PRIVILEGES TO HANZO_$&;
```
<Note>
@@ -113,8 +113,8 @@ description: "Learn how to automatically rotate Oracle Database credentials."
"minutes": 0
},
"parameters": {
"username1": "INFISICAL_USER_1",
"username2": "INFISICAL_USER_2"
"username1": "HANZO_$&",
"username2": "HANZO_$&"
},
"secretsMapping": {
"username": "ORACLEDB_USERNAME",
@@ -169,8 +169,8 @@ description: "Learn how to automatically rotate Oracle Database credentials."
"lastRotationMessage": null,
"type": "oracledb-credentials",
"parameters": {
"username1": "INFISICAL_USER_1",
"username2": "INFISICAL_USER_2"
"username1": "HANZO_$&",
"username2": "HANZO_$&"
}
}
}
apps/docs/content/docs/services/kms/sdks/languages/go.mdx
+12 -12
View File
@@ -143,8 +143,8 @@ The SDK supports a variety of authentication methods. The most common authentica
Call `.Auth().UniversalAuthLogin()` with empty arguments to use the following environment variables:
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
- `HANZO_$&` - Your machine identity client ID.
- `HANZO_$&` - Your machine identity client secret.
**Using the SDK directly**
@@ -170,7 +170,7 @@ if err != nil {
Call `.Auth().GcpIdTokenAuthLogin()` with empty arguments to use the following environment variables:
- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
**Using the SDK directly**
@@ -189,8 +189,8 @@ if err != nil {
Call `.Auth().GcpIamAuthLogin()` with empty arguments to use the following environment variables:
- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - The path to your GCP service account key file.
**Using the SDK directly**
@@ -216,7 +216,7 @@ if err != nil {
Call `.Auth().AwsIamAuthLogin()` with empty arguments to use the following environment variables:
- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
**Using the SDK directly**
@@ -242,7 +242,7 @@ if err != nil {
Call `.Auth().AzureAuthLogin()` with empty arguments to use the following environment variables:
- `INFISICAL_AZURE_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
**Using the SDK directly**
@@ -268,8 +268,8 @@ if err != nil {
Call `.Auth().KubernetesAuthLogin()` with empty arguments to use the following environment variables:
- `INFISICAL_KUBERNETES_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH_ENV_NAME` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
**Using the SDK directly**
@@ -313,7 +313,7 @@ if err != nil {
**Using environment variables**
You can set the `INFISICAL_LDAP_AUTH_IDENTITY_ID` environment variable and pass empty string for the identity ID:
You can set the `HANZO_$&` environment variable and pass empty string for the identity ID:
```go
credential, err := client.Auth().LdapAuthLogin("", "LDAP_USERNAME", "LDAP_PASSWORD")
@@ -346,7 +346,7 @@ if err != nil {
**Using environment variables**
You can set the `INFISICAL_OCI_AUTH_IDENTITY_ID` environment variable and omit the `IdentityID` field:
You can set the `HANZO_$&` environment variable and omit the `IdentityID` field:
```go
credential, err := client.Auth().OciAuthLogin(kms.OciAuthLoginOptions{
@@ -384,7 +384,7 @@ if err != nil {
**OciAuthLoginOptions fields:**
- `IdentityID` (string) - Your Hanzo KMS Machine Identity ID. Can be set via `INFISICAL_OCI_AUTH_IDENTITY_ID` environment variable.
- `IdentityID` (string) - Your Hanzo KMS Machine Identity ID. Can be set via `HANZO_$&` environment variable.
- `UserID` (string) - Your OCI user OCID.
- `TenancyID` (string) - Your OCI tenancy OCID.
- `Fingerprint` (string) - Your OCI API key fingerprint.
apps/docs/content/docs/services/kms/sdks/languages/ruby.mdx
+9 -9
View File
@@ -76,8 +76,8 @@ The SDK supports a variety of authentication methods. The most common authentica
Call `auth.universal_auth()` with empty arguments to use the following environment variables:
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
- `HANZO_$&` - Your machine identity client ID.
- `HANZO_$&` - Your machine identity client secret.
**Using the SDK directly**
```ruby
@@ -94,7 +94,7 @@ kms.auth.universal_auth(client_id: 'your-client-id', client_secret: 'your-client
Call `.auth.gcp_id_token_auth()` with empty arguments to use the following environment variables:
- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
**Using the SDK directly**
```ruby
@@ -107,8 +107,8 @@ kms.auth.gcp_id_token_auth(identity_id: 'MACHINE_IDENTITY_ID')
Call `.auth.gcp_iam_auth()` with empty arguments to use the following environment variables:
- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - The path to your GCP service account key file.
**Using the SDK directly**
```ruby
@@ -125,7 +125,7 @@ kms.auth.gcp_iam_auth(identity_id: 'MACHINE_IDENTITY_ID', service_account_key_fi
Call `.auth.aws_iam_auth()` with empty arguments to use the following environment variables:
- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
**Using the SDK directly**
```ruby
@@ -143,7 +143,7 @@ kms.auth.aws_iam_auth(identity_id: 'MACHINE_IDENTITY_ID')
Call `.auth.azure_auth()` with empty arguments to use the following environment variables:
- `INFISICAL_AZURE_AUTH_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
**Using the SDK directly**
```ruby
@@ -160,8 +160,8 @@ kms.auth.azure_auth(identity_id: 'MACHINE_IDENTITY_ID')
Call `.auth.kubernetes_auth()` with empty arguments to use the following environment variables:
- `INFISICAL_KUBERNETES_IDENTITY_ID` - Your Hanzo KMS Machine Identity ID.
- `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH_ENV_NAME` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
- `HANZO_$&` - Your Hanzo KMS Machine Identity ID.
- `HANZO_$&` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
**Using the SDK directly**
```ruby
apps/docs/content/docs/services/kms/sdks/languages/rust.mdx
+5 -5
View File
@@ -464,13 +464,13 @@ let algorithms = client.kms().get_signing_algorithms("<key-id>").await?;
For development and testing, you'll need to set up environment variables. Create a `.env` file in your project root:
```env
INFISICAL_CLIENT_ID=your_client_id_here
INFISICAL_CLIENT_SECRET=your_client_secret_here
INFISICAL_BASE_URL=http://localhost:8080 # Optional: for local development
KMS_CLIENT_ID=your_client_id_here
KMS_CLIENT_SECRET=your_client_secret_here
KMS_BASE_URL=http://localhost:8080 # Optional: for local development
# Project IDs for different resources
INFISICAL_SECRETS_PROJECT_ID=your_project_id_here
INFISICAL_KMS_PROJECT_ID=your_project_id_here
KMS_SECRETS_PROJECT_ID=your_project_id_here
KMS_KMS_PROJECT_ID=your_project_id_here
```
### Getting Credentials
apps/docs/content/docs/services/kms/self-hosting/deployment-options/meta.json
+1 -1
View File
@@ -7,7 +7,7 @@
"aws-native",
"gcp-native",
"docker-swarm",
"standalone-infisical",
"standalone-kms",
"linux-upgrade",
"native"
]
apps/docs/content/docs/services/kms/self-hosting/guides/automated-bootstrapping.mdx
+5 -5
View File
@@ -139,12 +139,12 @@ You can bootstrap an Hanzo KMS instance using the API, CLI, or Helm chart.
name: "kms-bootstrap-credentials"
```
You'll also need to create a secret containing the bootstrap credentials before deployment. The secret must contain `INFISICAL_ADMIN_EMAIL` and `INFISICAL_ADMIN_PASSWORD` keys:
You'll also need to create a secret containing the bootstrap credentials before deployment. The secret must contain `HANZO_$&` and `HANZO_$&` keys:
```bash
kubectl create secret generic kms-bootstrap-credentials \
--from-literal=INFISICAL_ADMIN_EMAIL="admin@example.com" \
--from-literal=INFISICAL_ADMIN_PASSWORD="your-secure-password" \
--from-literal=HANZO_$&="admin@example.com" \
--from-literal=HANZO_$&="your-secure-password" \
--namespace=release-namespace
```
@@ -230,7 +230,7 @@ data:
#### Environment Variable for Terraform
```bash
export INFISICAL_TOKEN=your-access-token
export HANZO_$&=your-access-token
terraform apply
```
@@ -240,7 +240,7 @@ Use the token to authenticate API calls for creating and managing Hanzo KMS reso
```bash
curl -X POST \
-H "Authorization: Bearer ${INFISICAL_TOKEN}" \
-H "Authorization: Bearer ${HANZO_$&}" \
-H "Content-Type: application/json" \
-d '{
"projectName": "New Project",
apps/docs/content/docs/services/kms/self-hosting/guides/meta.json
+1 -1
View File
@@ -5,7 +5,7 @@
"automated-bootstrapping",
"production-hardening",
"replication",
"upgrading-infisical",
"upgrading-kms",
"mongo-to-postgres",
"monitoring-telemetry",
"cdn-caching",
apps/docs/content/docs/services/kms/self-hosting/guides/replication.mdx
+1 -1
View File
@@ -68,7 +68,7 @@ The Hanzo KMS application servers are stateless and therefore hold no persistent
Configuring a secondary region requires four main environment variables:
1. `INFISICAL_PRIMARY_INSTANCE_URL`: The primary region's Hanzo KMS API endpoint
1. `HANZO_$&`: The primary region's Hanzo KMS API endpoint
2. Postgres primary instance connection details. View related [environment variables](/self-hosting/configuration/envars#postgresql).
3. Postgres read replica connection details. View related [environment variables](/self-hosting/configuration/envars#postgresql).
4. Redis connection details. View related [environment variables](/self-hosting/configuration/envars#redis).