Use HashiCorp Vault as a secret manager

Last published : Oct 20, 2026
You can use HashiCorp Vault to store all platform secrets instead of encrypting them in MongoDB.
Citrix SecurSpaces™ Platform connects to HashiCorp Vault using the JWT authentication mechanism provided by Kubernetes.
For more information, see Use Kubernetes for OIDC authentication
Related information
Integrations

Prerequisites

The configuration depends on whether your Vault instance is deployed in the same Kubernetes cluster as the SecurSpaces Platform:
  • If Vault is deployed in the same cluster:
    The OpenID Connect (OIDC) issuer endpoint is automatically reachable.
  • If Vault is deployed in a different cluster:
    Ensure that the OIDC issuer endpoint of the SecurSpaces cluster is reachable by Vault. If it isn’t, you must manually add the signing public key(s) of the SecurSpaces cluster.
    For details, see Use Kubernetes for OIDC authentication

Configuration

You can configure Vault in the SecurSpaces Platform using the following four Helm chart values:
# hashicorpVault:
#   If set, secrets are stored in Vault instead of the database.
#   vaultAddress: "https://example.com:8200"
#   vaultRoleName: "sds-role"
#   customMountPath: "" # Default is "secret"
#   vaultCertB64: ""    # Base64-encoded PEM CA certificate (optional)

Parameter descriptions

Parameter Description
vaultAddress Specifies the Vault address. The Vault instance must be accessible from the SecurSpaces cluster. All platform services use this address to store and retrieve secrets.
vaultRoleName Specifies the name of the Vault role configured for SecurSpaces. If different Kubernetes services use different service accounts, the bound_subject field may vary. You can omit this field when creating the role.
customMountPath Specifies the Vault path where secrets are stored. Optional. Defaults to secret.
vaultCertB64 Specifies the Base64-encoded TLS certificate for Vault. Use this setting if Vault uses a self-signed certificate. Optional.