Merge remote-tracking branch 'origin/candidate-9.10.x' into candidate-9.12.x

Signed-off-by: Gavin Halliday <gavin.halliday@lexisnexis.com>

Author: ghalliday

docs/EN_US/ContainerizedHPCC/ContainerizedMods/CustomConfig.xml

@@ -1467,6 +1467,30 @@ thor: []
         credentials.</para>
       </sect3>
 
+      <sect3 id="Deploying_AkeylessVault">
+        <title>Deploy the Akeyless Vaultless Platform</title>
+
+        <para>To use Akeyless, set the vault type to <emphasis>akeyless</emphasis>
+        and the kind to <emphasis>akeyless</emphasis>. The URL should point to
+        the Akeyless API endpoint or your gateway. Provide an access ID and
+        access key, typically from environment variables or a secure secret.
+        A token can also be supplied via the client-secret if desired.</para>
+
+        <programlisting lang="YAML">  vaults:
+  authn:
+    - name: my-authn-akeyless
+      type: akeyless
+      kind: akeyless
+      url: https://api.akeyless.io
+      accessId: ${env.AKEYLESS_ACCESS_ID}
+      accessKey: ${env.AKEYLESS_ACCESS_KEY}
+</programlisting>
+
+        <para>The secret name referenced by HPCC (for example, in LDAP settings)
+        is passed to Akeyless as the secret name in the get-secret-value API.
+        If a version is provided, it will be used when retrieving the secret.</para>
+      </sect3>
+
       <sect3 id="REF_HASHICORPVault_LDAP">
         <title>Referencing Vault Stored Authentication</title>
 

helm/hpcc/templates/_helpers.tpl

@@ -718,6 +718,9 @@ vaults:
   {{- range $vault := . }}
     - name: {{ $vault.name }}
       kind: {{ $vault.kind }}
+    {{- if $vault.type }}
+      type: {{ $vault.type }}
+    {{- end }}
     {{- if $vault.namespace }}
       namespace: {{ $vault.namespace }}
     {{- end }}
@@ -734,6 +737,15 @@ vaults:
     {{- if index $vault "appRoleSecret" }}
       appRoleSecret: {{ index $vault "appRoleSecret" }}
     {{- end -}}
+    {{- if index $vault "accessId" }}
+      accessId: {{ index $vault "accessId" }}
+    {{- end -}}
+    {{- if index $vault "accessKey" }}
+      accessKey: {{ index $vault "accessKey" }}
+    {{- end }}
+    {{- if index $vault "accessType" }}
+      accessType: {{ index $vault "accessType" }}
+    {{- end -}}
     {{- if $vaultClientIssuerEnabled }}
      {{- if not (index $vault "client-secret") }}
       {{- if not (index $vault "appRoleId") }}

helm/hpcc/values.schema.json

@@ -944,6 +944,19 @@
           "type": "string",
           "enum": ["kv-v2", "kv-v1"]
         },
+        "type": {
+          "description": "The vault provider type (e.g. 'akeyless' or kv backend)",
+          "type": "string",
+          "enum": ["kv-v2", "kv-v1", "akeyless"]
+        },
+        "accessId": {
+          "description": "Access ID used by Akeyless-style vaults",
+          "type": "string"
+        },
+        "accessKey": {
+          "description": "Access Key used by Akeyless-style vaults",
+          "type": "string"
+        },
         "client-secret": {
           "description": "optional name of kubernetes secret that will provide the vault client token",
           "type": "string"