diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md index 816c071ed..f60c94cb9 100644 --- a/docs/guides/configuration.md +++ b/docs/guides/configuration.md @@ -67,6 +67,7 @@ It can also be passed as parameters to extensions like `FlaskDynaconf` or set in VAULT_ENABLED | bool | Vault server is enabled. | false | VAULT_ENABLED_FOR_DYNACONF=true VAULT_HOST | str | Vault host. | localhost | VAULT_HOST_FOR_DYNACONF=”server” VAULT_PATH | str | Vault path to the configuration. | None | VAULT_PATH_FOR_DYNACONF=”secret_data” + VAULT_MOUNT_POINT | str | Vault mount point to the configuration. | secret | VAULT_MOUNT_POINT_FOR_DYNACONF=”kv” VAULT_PORT | str | Vault port. | 8200 | VAULT_PORT_FOR_DYNACONF=”2800” VAULT_PROXIES | dict | Vault proxies. | None | VAULT_PROXIES_FOR_DYNACONF={http=”http:/localhost:3128/”} VAULT_ROLE_ID | str | Vault Role ID. | None | VAULT_ROLE_ID_FOR_DYNACONF=”some-role-id” diff --git a/dynaconf/default_settings.py b/dynaconf/default_settings.py index b63209d7f..b31ea7b63 100644 --- a/dynaconf/default_settings.py +++ b/dynaconf/default_settings.py @@ -165,6 +165,9 @@ def reload(*args, **kwargs): VAULT_FOR_DYNACONF = get("VAULT_FOR_DYNACONF", default_vault) VAULT_ENABLED_FOR_DYNACONF = get("VAULT_ENABLED_FOR_DYNACONF", False) VAULT_PATH_FOR_DYNACONF = get("VAULT_PATH_FOR_DYNACONF", "dynaconf") +VAULT_MOUNT_POINT_FOR_DYNACONF = get( + "VAULT_MOUNT_POINT_FOR_DYNACONF", "secret" +) VAULT_ROLE_ID_FOR_DYNACONF = get("VAULT_ROLE_ID_FOR_DYNACONF", None) VAULT_SECRET_ID_FOR_DYNACONF = get("VAULT_SECRET_ID_FOR_DYNACONF", None) diff --git a/dynaconf/loaders/vault_loader.py b/dynaconf/loaders/vault_loader.py index ef9462ebd..1c87937ee 100644 --- a/dynaconf/loaders/vault_loader.py +++ b/dynaconf/loaders/vault_loader.py @@ -51,8 +51,11 @@ def load(obj, env=None, silent=None, key=None): env_list = build_env_list(obj, env) for env in env_list: path = "/".join([obj.VAULT_PATH_FOR_DYNACONF, env]) + mount_point = obj.VAULT_MOUNT_POINT_FOR_DYNACONF try: - data = client.secrets.kv.read_secret_version(path) + data = client.secrets.kv.read_secret_version( + path, mount_point=mount_point + ) except InvalidPath: # If the path doesn't exist, ignore it and set data to None data = None @@ -103,7 +106,10 @@ def write(obj, data=None, **kwargs): raise AttributeError("Data must be provided") client = get_client(obj) path = "/".join([obj.VAULT_PATH_FOR_DYNACONF, obj.current_env.lower()]) - client.secrets.kv.create_or_update_secret(path, secret=data) + mount_point = obj.VAULT_MOUNT_POINT_FOR_DYNACONF + client.secrets.kv.create_or_update_secret( + path, secret=data, mount_point=mount_point + ) load(obj)