Configure HashiCorp keyvault - Precisely Data Integrity Suite

Set up a HashiCorp Vault connection

Before you begin:

• You have network access to your Vault instance.
• You can run DISCLI commands (required for agent authentication).
• You have the appropriate Vault credentials: AppRole values, TLS certificate files, or a secret file.

1. Navigate to Configuration > Key Vault.

2. Click Add Key Vault and fill in the following details:

   Table 1. HashiCorp Vault Configuration Fields

   Field	Description
   Key vault name	A name that reflects its purpose or environment.
   Description	A summary of the key vault's role or scope to clarify its usage. This field is optional.
   Key vault type	Select HashiCorp Vault from the dropdown list.
   Host URL	The URL or endpoint of the HashiCorp Vault server. The Data Integrity Suite uses this address to connect and retrieve credentials.
   Namespace	The Vault Enterprise namespace in which authentication methods, policies, and secrets are defined. Namespaces provide logical isolation within Vault. If your organization uses Vault namespaces, enter the appropriate namespace path. Leave this field empty when using the root namespace. This field is optional.
   Authentication method	The method used to authenticate with HashiCorp Vault. Choose one of the following: Vault AppRole: Authenticates using an AppRole ID and Secret ID. Commonly used in automated environments such as CI/CD pipelines and backend services. Role ID: The identifier of the application or service requesting access. Secret ID: The secure token used to confirm identity when accessing the vault. TLS Certificate: Authenticates using a digital certificate that establishes a secure, encrypted connection to the vault. TLS certificate ID: The identifier of the certificate used for authentication. What's changed: In the new user experience, TLS certificate ID appears as TLS certificate. For more information on the new experience, see About the new user experience. Private key: The secure key paired with the TLS certificate to verify identity and establish the connection. Precisely Agent: A secure intermediary that retrieves credentials from the vault when direct access is not available. Commonly used in on-premises or hybrid environments where the application cannot connect to the vault directly. Agent secret name: The reference used by the agent to locate and retrieve the correct secret from the vault. Test agent: Select an agent from the dropdown list to test the connection. This optional selection is only used for testing and is not stored.

3. If you selected Precisely Agent as the authentication method, install the agent secret before proceeding. See Install vault agent secret.
4. Click Test to validate the agent or cloud configuration.
5. Once the test succeeds, click Add to complete the key vault setup.

The key vault connection is now configured and ready to use with shared connections.

Install vault agent secret

The agent secret is required when using Precisely Agent authentication. Configure it using one of the available methods before completing your key vault setup.

Before you begin:

• You have network access to your Vault instance.
• You can run DISCLI commands.
• You have the appropriate Vault credentials: AppRole values, TLS certificate files, or a secret file.

1. If you're installing the agent for the first time, no additional steps are required. To install the agent, see Install and download agent.

2. If the agent is already installed in your environment, run the following command to enable the key vault agent secret feature:

   ./discli updateCli

3. After the update completes, configure the vault agent secret using one of the following methods. Replace variables in angle brackets (< >) with your own values. Do not include the brackets when running commands.

   Option 1: AppRole authentication

   ./discli keyvault deploySecret \
     --agent-secret-key <agent secret key> \
     --url <hostUrl:port> \
     --authentication-method approle \
     --role-id <role-id> \
     --secret-id <secret-id>

   Option 2: TLS certificate authentication

   ./discli keyvault deploySecret \
     --agent-secret-key <agent secret key> \
     --url <hostUrl:port> \
     --authentication-method tls \
     --tls-cert-file <cert pem file> \
     --private-key-file <key pem file>

   Option 3: Secret file

   ./discli keyvault deploySecret \
     --agent-secret-key <agent secret key> \
     --agent-secret-file <agentSecretFile.json>

   The JSON file must follow one of these formats:

   For AppRole authentication:

   {
     "hostname": "<host url:port>",
     "authenticationMethod": "approle",
     "roleId": "<role id>",
     "secretId": "<secret id>",
     "vaultType": "hashicorp"
   }

   For TLS certificate authentication:

   {
     "hostname": "<host url:port>",
     "authenticationMethod": "tls",
     "tlsCertificate": "<tls certificate>",
     "privateKey": "<private key>",
     "vaultType": "hashicorp"
   }

4. Verify the agent secret was installed correctly by running:

   ./discli keyvault deploySecret --listkeys

   This command lists all keys available across namespaces. Look for the key name under your relevant namespace. Example output:

   Listing keys in 'precisely-keyvault-secret'
   agentaprolesecret
   SUCCESS: Total keys: 1

   The key name (for example, agentaprolesecret) must exactly match the value you configure as Agent secret name in the UI key vault connection.

5. If no keys are found, the output shows:

   INFO: Secret 'precisely-keyvault-secret' missing in <namespace>

   This indicates that no keys have been deployed in that namespace. Run the deployment command again with the correct namespace.

6. To explore additional options for this command, run:

   ./discli keyvault deploySecret --help

   This displays supported flags such as --listkeys, which can assist during validation and troubleshooting.

The agent secret is installed and ready to use. Return to the Add Key Vault page, select the agent secret key you created, and complete the key vault setup.