Apache Hop

Functionality

This variable resolver can retrieve secrets from an OpenBAO instance. The editor is the same as the HashiCorp Vault variable resolver: options are grouped into Connection, Authentication and Secrets, and the Authentication tab only shows the fields that belong to the authentication type you picked.

Here are the options to use:

OpenBAO address: The base address and port of the OpenBAO server (for example: https://openbao-server:8200)
Authentication type: How Hop proves its identity to OpenBAO. TOKEN is the default and keeps existing resolvers working. KUBERNETES is intended for Hop Server (or Hop Gui) running in a Kubernetes pod.
OpenBAO token: The token to use to authenticate. Shown only when the authentication type is TOKEN.
Kubernetes role: The OpenBAO Kubernetes auth role bound to this workload’s ServiceAccount. Shown only when the authentication type is KUBERNETES.
Kubernetes JWT file path: File that holds the ServiceAccount JWT. Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token when left empty. Shown only for KUBERNETES.
Kubernetes JWT: Optional JWT string used instead of the file when set (a variable such as '${KUBERNETES_JWT}' is typical). Shown only for KUBERNETES.
Kubernetes auth mount path: OpenBAO auth mount without the leading auth/. Defaults to kubernetes. Shown only for KUBERNETES.
Namespace: The namespace to use (optional, primarily used in enterprise/multi-tenant setups)
Path prefix: an optional path prefix which gets added before the key paths in the resolver expressions. For example, if you put kv-other/data in here, expression

#{openbao:db:password}

will resolve internally to:

#{openbao:kv-other/data/db:password}

Validate HTTPS connections?: Verifies the certificate the OpenBAO server presents. On for new resolvers. Leave it on in production, and identify the certificate with one of the two PEM options below when the server does not use a certificate from a public CA.
PEM file path: The name of the file (VFS) containing the X.509 certificate string
PEM string: The X.509 string itself in case you’re not using a file
Open connection timeout: The connection timeout when getting a http(s) connection in milliseconds.
Read connection timeout: The timeout in milliseconds when reading.

Validate HTTPS connections? became the default in Hop 2.20. The option is stored in the resolver, so resolvers created before that keep the setting they have: verification stays off in every resolver definition that was saved with the box unticked, whatever Hop version you upgrade to. Open your OpenBAO and Vault resolvers and check the option rather than assuming the upgrade covered them. Hop logs a warning when a resolver reaches an https address without verifying the certificate.

A resolver that verifies the certificate needs to be able to build the chain to a trusted root. Against an OpenBAO with a self-signed certificate or one signed by a private CA, give the resolver that certificate through PEM file path or PEM string; without it the lookup fails and the expression is left unresolved.

The variable expression you can resolve with this plugin type is (as always) in the following format:

#{name:path-key:value-key}

name: the name of the variable resolver metadata element to use
path-key: the path to the secret in OpenBAO.
value-key: the key of the value to retrieve.

In case we don’t specify a value-key, you will give back the complete JSON string of the secret.

Example

We can define a connection called openbao and retrieve values with expressions:

#{openbao:hop/data/some-db:hostname} : localhost
#{openbao:hop/data/some-db:username} : john
#{openbao:hop/data/some-db} : {"db":"test","hostname":"localhost","password":"some-password","port":"3306","username":"john"}

Kubernetes authentication

When Hop runs inside a Kubernetes pod, prefer KUBERNETES over a long-lived OpenBAO token. Hop reads the pod ServiceAccount JWT, logs in to OpenBAO’s Kubernetes auth backend, and uses the short-lived client token OpenBAO returns. That token is kept in memory, renewed when OpenBAO says it is renewable, and replaced by a fresh login when it expires. It is never stored in the resolver metadata.

On the OpenBAO side, enable Kubernetes auth and bind a role to the ServiceAccount Hop runs as, then set Authentication type to KUBERNETES and Kubernetes role to that role name. Leave the JWT file path empty to use the token Kubernetes mounts at /var/run/secrets/kubernetes.io/serviceaccount/token.