Secret usage with backup and restore

absctl backup and absctl restore support retrieving values from the Aerospike Secret Agent. This makes it possible to use sensitive information like TLS certificates and passwords as arguments without storing them on the same machine as absctl.

To use secrets as arguments, the Secret Agent must be running and accessible by absctl. Use the following options to connect to the Secret Agent.

Secret Agent options

absctl backup and absctl restore both support the same Secret Agent-related options.

Option	Default	Description
--sa-address HOST_OR_SOCKET_PATH	Unset	Secret Agent host for a TCP connection or socket file path for a Unix domain socket connection.
--sa-port PORT	0	Secret Agent port for a TCP connection.
--sa-timeout MILLISECONDS	10000	Connection and read timeout.
--sa-ca-file PATH	Unset	Path to a trusted CA certificate in PEM format. This option enables TLS for the Secret Agent connection.
--sa-cert-file PATH	Unset	Path to a client certificate for mutual TLS authentication.
--sa-key-file PATH	Unset	Path to a client private key for mutual TLS authentication.
--sa-tls-name NAME	Unset	TLS name (SNI) for encrypted connections.
--sa-connection-type TYPE	TCP	Connection type. Supported values are TCP and UNIX.
--sa-is-base64	false	Whether Secret Agent responses are Base64 encoded.

Danger

TCP connections to the Secret Agent are unencrypted unless you configure --sa-ca-file. Use a Unix domain socket for local connections or TLS, preferably mutual TLS, for TCP connections carrying credentials, certificates, or private keys.

Secret arguments

On the command line, absctl 1.1.0 can resolve Secret Agent references for the following connection and credential options:

• Aerospike Database connection options: --host, --port, --user, --password, --tls-name, --tls-cafile, --tls-capath, --tls-certfile, --tls-keyfile, --tls-keyfile-password, and --tls-protocols
• Encryption key source options: --encryption-key-file and --encryption-key-env
• Amazon S3 options: bucket, region, profile, endpoint, access key, secret key, storage class, and access tier
• Azure Blob Storage options: account name, account key, tenant ID, client ID, client secret, endpoint, container, and access tier
• Google Cloud Storage options: key path, bucket, and endpoint

Other options, including operation settings such as namespace, parallelism, and logging, do not accept Secret Agent references. The options that configure the Secret Agent itself and --config also do not accept Secret Agent references.

In YAML configuration files, Secret Agent references are supported for database usernames and passwords, TLS CA, certificate, key, and key-password fields, encryption key-file and key-environment fields, and the cloud string fields listed previously. Seed hosts and ports do not support Secret Agent references in YAML.

absctl 1.0.0 limits Secret Agent references to cloud-provider options and the Aerospike Database username and password. It does not resolve --host, --port, or --tls-* options through the Secret Agent.

The format for using a secret as an argument is secrets[:<resource_name>]:<secret_key>. See the Aerospike Secret Agent documentation for information about resource names, secret names, and how to set up the Secret Agent service.

Note

• By default, absctl treats Secret Agent responses as unencoded values. Set --sa-is-base64 when the Secret Agent returns Base64-encoded values.
• Some arguments, such as --tls-cafile, normally expect a file path. For secret-backed certificate arguments, absctl treats the Secret Agent value as literal certificate data instead of a file path.

Using secrets from Secret Agent

This example uses the secret pass from Secret Agent resource resource1 as the absctl backup password argument.

absctl backup --sa-address 127.0.0.1:3005 --password secrets:resource1:pass -n test --output-file -

Secrets can also be used from a YAML configuration file passed via the --config flag. The following example configuration file causes absctl backup to connect to the Secret Agent at secretagent:3006 using TLS and the certificate at path/to/cacert.pem. absctl backup then retrieves the database username, password, and TLS CA certificate from the Secret Agent.

cluster:
  seeds:
    - host: 172.4.25.1
      port: 3000
  user: "secrets:resource1:db_user"
  password: "secrets:resource1:db_password"
  tls:
    enable: true
    cafile: "secrets:resource1:aerospike_cafile"
secret-agent:
  address: "secretagent"
  port: 3006
  ca-file: "path/to/cacert.pem"

Seed hosts cannot use Secret Agent references in YAML. Use --host to retrieve a host value from the Secret Agent:

absctl backup \
  --sa-address secretagent \
  --sa-port 3006 \
  --host secrets:resource1:aerospike_host \
  --namespace test \
  --output-file -