Skip to main content
Version: Next

Step 3 - Add secrets in Key Vault

Storage account connection string​

To enable the CDR Platform's access to the reporting storage account ('saname'), the connection string is required in Key Vault.

  • You can retrieve the connection string through the Azure Portal or via the Azure CLI as shown in the example below. Just remember to enter your storage account and resource group.
az storage account show-connection-string --name "${saname}" -g "${rgp}"

image.png

  • Enter your connection string (highlighted in the screenshot) by replacing ${saconnstring}, and enter your Key Vault by replacing ${kvname} (as below).
az keyvault secret set --name "azure-storage-connectionstring" --vault-name "${kvname}" --value "${saconnstring}"

Database Option 1 - MongoDB connection string​

To enable Halo's connection to the Database, the connection string of the MongoDB should be created in the KeyVault

  • You can retrieve the connection string of the CosmosDB(Mongodb complatible) through the Azure Portal or via the Azure CLI as shown in the example below. Just remember to enter your Cosmos DB account name and resource group. The command will provide a list of 4 connection strings. You may use any one of the first 2 connections strings. You cannot use the Read-Only connection strings.
az cosmosdb list-connection-strings --name "${cosmosdb_name}" -g "${rgp}"
  • Enter your connection string (highlighted in the screenshot) by replacing ${mongodb_connstring}, and enter your Key Vault by replacing ${kvname} (as below).
az keyvault secret set --name "mongodb-connectionstring" --vault-name "${kvname}" --value "${mongodb_connstring}"

Add the MongoDB passwords to Azure keyvault as a secret​

Note: If you have previously configured and setup MongoDB within Azure and have created your MongoDB connection string as listed above, you can skip this step.

If not, to enable Glasswall Halo's Policy API to create and manage the policies in MongoDB, and Async API to create and manage the requests, MongoDB needs to be deployed using Helm charts listed in Step 8.

Two users will be created by the MongoDB Helm chart and the corresponding user's password needs to be set in the Vault secret.

az keyvault secret set --name "mongodb-cdrp-password" --vault-name "${kvname}" --value "<cdrp-user-password>"
az keyvault secret set --name "mongodb-admin-password" --vault-name "${kvname}" --value "<admin-user-password>"

Database Option 2 - CosmosDB connection string​

If CosmosDB is setup instead of MongoDB, the Cosmos connection string should be added to KeyVault.

  • You can retrieve the connection string of CosmosDB through the Azure Portal or via the Azure CLI as shown in the example below. Just remember to enter your Cosmos DB account name and resource group. The command will provide a list of 4 connection strings. You may use any one of the first 2 connections strings. You cannot use the Read-Only connection strings.
az cosmosdb list-connection-strings --name "${cosmosdb_name}" -g "${rgp}"
  • Enter your connection string (highlighted in the screenshot) by replacing ${mongodb_connstring}, and enter your Key Vault by replacing ${kvname} (as below).
az keyvault secret set --name "mongodb-connectionstring" --vault-name "${kvname}" --value "${mongodb_connstring}"

Reversing Labs credentials (Optional)​

To integrate the Halo with Reversing Labs, add the credentials of the Reversing Labs to the KeyVault. Replace ${reversinglabs_username} and ${reversinglabs_password} with actual username and password.

az keyvault secret set --name "halo-reversinglabs-username" --vault-name "${kvname}" --value "${reversinglabs_username}"
az keyvault secret set --name "halo-reversinglabs-password" --vault-name "${kvname}" --value "${reversinglabs_password}"

ICAP MTLS certificates (Optional)​

ICAP servers can be configured for mutual client authentication using the MTLS certificates. The certificates will be mounted to the ICAP server pods using the Kubernetes secrets. Add the server certificates and certificate authority to the Keyvault so that they can be synced to Kubernetes secrets.

az keyvault secret set --vault-name "${kvname}" --name tls-server-cert -f <path/to/mtls-server-cert.pem>
az keyvault secret set --vault-name "${kvname}" --name tls-server-key -f <path/to/mtls-server-key.pem>
az keyvault secret set --vault-name "${kvname}" --name tls-cafile -f <path/to/mtls-ca-cert.pem>