Vault
HomeDocumentationTutorialsTry Cloud!
  • Vault
  • Documentation
    • What is Vault?
    • Use Cases
    • Setup
      • Install
      • Configuration
    • Get Started
      • Starting the server
      • Your first secret
      • Deploying Vault on VMs with Let's encrypt! TLS certs
    • Concepts
      • Operations
        • Seal/Unseal
        • "Dev" server mode
        • Namespace lock and unlock
        • Lease, renew, and revoke
        • Lease Explosions
        • Mount migration
        • Client count
        • Resource quotas
        • Response wrapping
      • Authentication
        • Identity
        • Tokens
        • OIDC provider
        • Username templating
        • Passwordless
      • Secrets
      • Storage
        • Integrated storage
        • High availability mode (HA)
        • Recovery mode
      • Policies
  • Tutorials
    • CLI
      • Operations
        • Deploy Vault
        • Using the HTTP API
        • Unseal/Seal
      • Authentication
        • Token
        • GitHub authentication
        • Username/Password
        • TLS Client Certificates
        • SSH Keys
        • AWS, Azure, GCP and external auth methods
          • Azure
          • AWS
          • GCP
          • Github
          • Terraform
      • Secrets
        • Secrets engines
        • Built-in help
      • Access Control
        • Policies
    • UI
      • Authentication
        • Username/Password
        • Passwordless
      • Operations
        • Unseal / Seal
        • API Explorer
      • Secrets
        • Secrets engines
      • Access Control
        • Policies
    • Use Cases
      • Namespaces
      • MongoDB admin password
      • VM Disk Encryption Keys
      • VM SSH Keys
      • Kubernetes Configuration
      • GitHub Actions
      • Dynamic credentials for cloud providers
        • AWS
        • Azure
        • GCP
  • CLI
    • agent
    • audit
    • auth
    • debug
    • delete
    • events
    • kv
    • lease
    • license
    • list
    • login
    • monitor
    • namespace
    • operator
    • patch
    • path-help
    • pki
    • plugin
    • policy
    • print
    • proxy
    • read
    • secrets
    • server
    • ssh
    • status
    • token
    • transit
    • unwrap
    • version
    • version-history
    • write
  • API
    • Secrets engines
      • AliCloud secrets engine (API)
      • AWS secrets engine (API)
      • Azure secrets engine (API)
      • Cubbyhole secrets engine (API)
      • Database
        • Cassandra database plugin HTTP API
        • Elasticsearch database plugin HTTP API
        • Influxdb database plugin HTTP API
        • MongoDB database plugin HTTP API
        • MSSQL database plugin HTTP API
        • MySQL/MariaDB database plugin HTTP API
        • Oracle database plugin HTTP API
        • PostgreSQL database plugin HTTP API
        • Redis database plugin HTTP API
        • Redis ElastiCache database plugin HTTP API
        • Redshift database plugin HTTP API
        • Snowflake database plugin HTTP API
      • Google Cloud secrets engine (API)
      • Google Cloud KMS secrets engine (API)
      • Identity
        • entity
        • entity-alias
        • group
        • group-alias
        • tokens
        • lookup
        • oidc-provider
        • MFA
          • duo
          • okta
          • pingid
          • totp
          • login-enforcement
      • KV secrets engine (API)
      • Buckypaper secrets engine
      • Kubernetes secrets engine (API)
      • Nomad secrets engine (API)
      • LDAP secrets engine (API)
      • PKI secrets engine (API)
      • RabbitMQ secrets engine (API)
      • SSH secrets engine (API)
      • TOTP secrets engine (API)
      • Transit secrets engine (API)
    • Auth engines
      • AliCloud auth method (API)
      • AppRole auth method (API)
      • AWS auth method (API)
      • Azure auth method (API)
      • Pivotal Cloud Foundry (CF) auth method (API)
      • GitHub auth method (API)
      • Google Cloud auth method (API)
      • JWT/OIDC auth method (API)
      • Kerberos auth method (API)
      • Kubernetes auth method (API)
      • LDAP auth method (API)
      • OCI auth method (API)
      • Okta auth method (API)
      • Passwordless auth method (API)
      • RADIUS auth method (API)
      • TLS certificate auth method (API)
      • Token auth method (API)
      • Userpass auth method (HTTP API)
    • Service engines
      • Licence Manager
    • System backend
      • /sys/audit
      • /sys/audit-hash
      • /sys/auth
      • /sys/capabilities
      • /sys/capabilities-accessor
      • /sys/capabilities-self
      • /sys/config/auditing/request-headers
      • /sys/config/control-group
      • /sys/config/cors
      • /sys/config/reload
      • /sys/config/state
      • /sys/config/ui
      • /sys/decode-token
      • /sys/experiments
      • /sys/generate-recovery-token
      • /sys/generate-root
      • /sys/health
      • /sys/host-info
      • /sys/in-flight-req
      • /sys/init
      • /sys/internal/counters
      • /sys/internal/inspect
        • /sys/internal/inspect/router
      • /sys/internal/specs/openapi
      • /sys/internal/ui/feature-flags
      • /sys/internal/ui/mounts
      • /sys/internal/ui/namespaces
      • /sys/internal/ui/resultant-acl
      • /sys/key-status
      • /sys/ha-status
      • /sys/leader
      • /sys/leases
      • /sys/license/status
      • /sys/locked-users
      • /sys/loggers
      • /sys/metrics
      • /sys/monitor
      • /sys/mounts
      • /sys/namespaces
      • /sys/plugins/reload/backend
      • /sys/plugins/catalog
      • /sys/plugins/runtimes/catalog
      • /sys/policy
      • /sys/policies/
      • /sys/policies/password/
      • /sys/pprof
      • /sys/quotas/config
      • /sys/quotas/rate-limit
      • /sys/quotas/lease-count
      • /sys/raw
      • /sys/rekey
      • /sys/rekey-recovery-key
      • /sys/remount
      • /sys/rotate
      • /sys/rotate/config
      • /sys/seal
      • /sys/seal-status
      • /sys/seal-backend-status
      • /sys/step-down
      • /sys/storage
        • /sys/storage/raft
        • /sys/storage/raft/autopilot
      • /sys/tools
      • /sys/unseal
      • /sys/version-history
      • /sys/wrapping/lookup
      • /sys/wrapping/rewrap
      • /sys/wrapping/unwrap
      • /sys/wrapping/wrap
  • Resources
    • Blog
    • GitHub
    • Youtube
    • CCx101
Powered by GitBook
On this page
  • Configure access
  • Read access configuration
  • Configure lease
  • Read lease configuration
  • Delete lease configuration
  • Create/Update role
  • Read role
  • List roles
  • Delete role
  • Generate credential
  1. API
  2. Secrets engines

Nomad secrets engine (API)

This is the API documentation for the Vault Nomad secrets engine. For general information about the usage and operation of the Nomad secrets engine, please see the Vault Nomad secrets engine documentation.

This documentation assumes the Nomad secrets engine is mounted at the /nomad path in Vault. Since it is possible to mount secrets engines at any location, please update your API calls accordingly.

Configure access

This endpoint configures the access information for Nomad. This access information is used so that Vault can communicate with Nomad and generate Nomad tokens.

Method
Path

POST

/nomad/config/access

Parameters

  • address (string: "") – Specifies the address of the Nomad instance, provided as "protocol://host:port" like "http://127.0.0.1:4646". This value can also be provided on individual calls with the NOMAD_ADDR environment variable.

  • token (string: "") – Specifies the Nomad Management token to use. This value can also be provided on individual calls with the NOMAD_TOKEN environment variable.

  • max_token_name_length (int: <optional>) – Specifies the maximum length to use for the name of the Nomad token generated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed by the Nomad version. For Nomad versions 0.8.3 and earlier, the default is 64. For Nomad version 0.8.4 and later, the default is 256.

  • ca_cert (string: "") - CA certificate to use when verifying Nomad server certificate, must be x509 PEM encoded.

  • client_cert (string: "") - Client certificate used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key.

  • client_key (string: "") - Client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.

Sample payload

{
  "address": "http://127.0.0.1:4646",
  "token": "adha...",
  "max_token_name_length": 256
}

Sample request

$ curl \
    --request POST \
    --header "X-Vault-Token: ..." \
    --data @payload.json \
    http://127.0.0.1:8200/v1/nomad/config/access

Read access configuration

This endpoint queries for information about the Nomad connection.

Method
Path

GET

/nomad/config/access

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/nomad/config/access

Sample response

  "data": {
    "address": "http://localhost:4646/"
  }

Configure lease

This endpoint configures the lease settings for generated tokens.

Method
Path

POST

/nomad/config/lease

Parameters

  • ttl (string: "") – Specifies the ttl for the lease. Uses duration format strings.

  • max_ttl (string: "") – Specifies the max ttl for the lease. Uses duration format strings.

Sample payload

{
  "ttl": 1800,
  "max_ttl": 3600
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/nomad/config/lease

Read lease configuration

This endpoint queries for information about the Lease TTL for the specified mount.

Method
Path

GET

/nomad/config/lease

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/nomad/config/lease

Sample response

  "data": {
    "max_ttl": 86400,
    "ttl": 86400
  }

Delete lease configuration

This endpoint deletes the lease configuration.

Method
Path

DELETE

/nomad/config/lease

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/nomad/config/lease

Create/Update role

This endpoint creates or updates the Nomad role definition in Vault. If the role does not exist, it will be created. If the role already exists, it will receive updated attributes.

Method
Path

POST

/nomad/role/:name

Parameters

  • name (string: <required>) – Specifies the name of an existing role against which to create this Nomad tokens. This is part of the request URL.

  • policies (string: "") – Comma separated list of Nomad policies the token is going to be created against. These need to be created beforehand in Nomad.

  • global (bool: "false") – Specifies if the token should be global, as defined in the Nomad Documentation.

  • type (string: "client") - Specifies the type of token to create when using this role. Valid values are "client" or "management".

Sample payload

To create a client token with a custom policy:

{
  "policies": "readonly"
}

Sample request

$ curl \
    --request POST \
    --header "X-Vault-Token: ..." \
    --data @payload.json \
    http://127.0.0.1:8200/v1/nomad/role/monitoring

Read role

This endpoint queries for information about a Nomad role with the given name. If no role exists with that name, a 404 is returned.

Method
Path

GET

/nomad/role/:name

Parameters

  • name (string: <required>) – Specifies the name of the role to query. This is part of the request URL.

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/nomad/role/monitoring

Sample response

{
  "data": {
    "lease": "0s",
    "policies": ["example"],
    "token_type": "client"
  }
}

List roles

This endpoint lists all existing roles in the secrets engine.

Method
Path

LIST

/nomad/role

GET

/nomad/role?list=true

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/nomad/role

Sample response

{
  "data": {
    "keys": ["example"]
  }
}

Delete role

This endpoint deletes a Nomad role with the given name. Even if the role does not exist, this endpoint will still return a successful response.

Method
Path

DELETE

/nomad/role/:name

Parameters

  • name (string: <required>) – Specifies the name of the role to delete. This is part of the request URL.

Sample request

$ curl \
    --request DELETE \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/nomad/role/example-role

Generate credential

This endpoint generates a dynamic Nomad token based on the given role definition.

Method
Path

GET

/nomad/creds/:name

Parameters

  • name (string: <required>) – Specifies the name of an existing role against which to create this Nomad token. This is part of the request URL.

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/nomad/creds/example

Sample response

{
  "data": {
    "accessor_id": "c834ba40-8d84-b0c1-c084-3a31d3383c03",
    "secret_id": "65af6f07-7f57-bb24-cdae-a27f86a894ce"
  }
}
PreviousKubernetes secrets engine (API)NextLDAP secrets engine (API)

Last updated 1 year ago