Tools written for HashiCorp Vault can read Monopam secrets without changes: the vault CLI, External Secrets Operator's vault provider, ArgoCD Vault Plugin, Terraform's vault provider and the Jenkins Vault plugin.
Applies to | Who can do this |
|---|---|
Monopam v2026.10 | Administrators turn it on. Pipelines and clusters use it with a machine identity. |
Turn it on
Open System → Secrets API and turn on the Vault-compatible API. It is off by default; while it is off, every /v1 path answers 404.
How paths map
Vault | Monopam |
|---|---|
Mount | Project |
First path segment | Environment |
Rest of the path | Folder |
Fields of a secret | Keys of the folder |
Example: vault kv get -mount=payments prod/db returns the keys of folder db in environment prod of project payments.
Logins
Vault login | Monopam identity |
|---|---|
| Universal Auth: |
| Kubernetes identity: |
| OIDC identity: |
Set VAULT_ADDR to the Monopam address. Grants, allowed IP ranges and audit apply exactly as for the machine API.
This is a read-only KV v2 subset. Writes, version selection, policies, PKI and database engines are not available, and PAM vault items are not reachable through it.
Related
- Identities and the CLI
- Projects and environments