Áú»¢¶Ä²©

13 Storage of secrets

Overview

Áú»¢¶Ä²© can be configured to retrieve sensitive information from a secure vault. The following secret management services are supported: HashiCorp Vault KV Secrets Engine - Version 2, CyberArk Vault CV12.

Secrets can be used for retrieving:

• user macro values
• database access credentials

Áú»¢¶Ä²© provides read-only access to the secrets in a vault, assuming that secrets are managed by someone else.

For information about specific vault provider configuration, see:

• HashiCorp configuration
• CyberArk configuration

Caching of secret values

By default, vault secret macro values are retrieved by Áú»¢¶Ä²© server on every refresh of configuration data and then stored in the configuration cache. Áú»¢¶Ä²© proxy receives values of vault secret macros from Áú»¢¶Ä²© server on each configuration sync and stores them in its own configuration cache.

It is also possible to configure that macro values are retrieved by Áú»¢¶Ä²© server and Áú»¢¶Ä²© proxy independently.

To manually trigger refresh of cached secret values from a vault, use the 'secrets_reload' command-line option.

For Áú»¢¶Ä²© frontend database credentials caching is disabled by default, but can be enabled by setting the option $DB['VAULT_CACHE'] = true in zabbix.conf.php. The credentials will be stored in a local cache using the filesystem temporary file directory. The web server must allow writing in a private temporary folder (for example, for Apache the configuration option PrivateTmp=True must be set). To control how often the data cache is refreshed/invalidated, use the ZBX_DATA_CACHE_TTL constant .

TLS configuration

To configure TLS for communication between Áú»¢¶Ä²© components and the vault, add a certificate signed by a certificate authority (CA) to the system-wide default CA store. To use another location, specify the directory in the SSLCALocation Áú»¢¶Ä²© server/proxy configuration parameter, place the certificate file inside that directory, then run the CLI :

c_rehash .