Deploy Vault Radar agent

The HCP Vault Radar agent allows you to scan on-premises data sources for secrets that are not accessible by the cloud scanner, and enable correlation between secrets found by Vault Radar that are store in Vault Enterprise.

Prerequisites

Access to HCP with an account that can create service principals
Vault Radar CLI installed
git must be installed on the host machine(s) or image
The agent requires the following environment variables to run and connect to HCP:

Create a service principal

Project-level service principals interact with resources within a specific project in an organization. By default, they can only access resources in the same project. However, you can assign roles to service principals projects beyond their original scope.

Create a project level service principal with the Vault Radar Agent role assigned.
Generate a key for the service principal.

Export an environment variable for the client ID and client secret.

$ export HCP_CLIENT_ID=actual-client-id HCP_CLIENT_SECRET=actual-client-secret

Create an agent pool in the HCP Portal

An agent pool is a group of agents that share the same HCP_RADAR_AGENT_POOL_ID, enabling higher throughput by horizontal scaling the number of agents.

Navigate to the HCP Portal navigate to HCP Vault Radar.
Click Settings.
Click Agent.
Click Add an agent pool and follow the prompts to create a new agent pool.
The final page displays the required configuration information. You can retrieve this information later from the Agent section of the settings page.
From the Connect the agent page, copy the commands to create environment variables for the pool ID and project ID.
Example:
```
$ export HCP_RADAR_AGENT_POOL_ID=actual-pool-id
export HCP_PROJECT_ID=actual-project-id
```

Configure secret values

For most data sources the agent is going to need credentials to authenticate with the data source itself. When configuring your data source on HCP, you may be prompted to define a credential needed for the integration to work.

Note

The agent is expecting a URI. The only resource supported is an environment variable.

Example:

$ env://ENV_VARIABLE_NAME

If you are configuring a GitHub data source, you are going to need to generate a GitHub PAT for the agent. Save the value of that PAT local to the agent as an environment variable. If you saved the environment variable as VAULT_RADAR_GIT_TOKEN then the URI for that variable entered on HCP should be env://VAULT_RADAR_GIT_TOKEN.

Additional configuration

The agent will respect configurations set by an .hashicorp/vault-radar/ignore.yaml. See Custom ignore rules
The agent will respect the log level set by the VAULT_RADAR_LOG_LEVEL environment variable. See supported log levels.

Connect a data source

You can set up a data source and manage it from the Vault Radar module in the HCP Portal.

Click Settings.
Click Data Sources.
Click Add data source.
Select agent scan.
Select the type of data source you want to set up. Provide the information prompted by the data source's form.

The recommended practice is to deploy the Agent using Kubernetes. A sample manifest is available alongside the releases.

Example deployment:

---
apiVersion: v1
kind: Namespace
metadata:
  name: vault-radar
  labels:
    app: vault-radar-agent

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-radar-agent
  namespace: vault-radar
  labels:
    app: vault-radar-agent

---
# Note: This cluster role binding is only required if you are using the Kubernetes auth method for Vault indexing feature.
# It is needed for Vault to be able to review the Kubernetes service account token and authenticate the Agent.
# See https://developer.hashicorp.com/vault/docs/auth/kubernetes#configuring-kubernetes

# apiVersion: rbac.authorization.k8s.io/v1
# kind: ClusterRoleBinding
# metadata:
#   name: vault-radar-agent
# roleRef:
#   apiGroup: rbac.authorization.k8s.io
#   kind: ClusterRole
#   name: system:auth-delegator
# subjects:
#   - kind: ServiceAccount
#     name: vault-radar-agent
#     namespace: vault-radar

---
apiVersion: v1
kind: Secret
metadata:
  name: vault-radar-secrets
  namespace: vault-radar
  labels:
    app: vault-radar-agent
type: Opaque
data:
  HCP_CLIENT_SECRET: <Base64 Encoded HCP_CLIENT_SECRET>
  VAULT_RADAR_GIT_TOKEN: <Base64 Encoded VAULT_RADAR_GIT_TOKEN>
  
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-radar-agent
  namespace: vault-radar
  labels:
    app: vault-radar-agent
spec:
  replicas: 2
  selector:
    matchLabels:
      app: vault-radar-agent
  template:
    metadata:
      labels:
        app: vault-radar-agent
    spec:
      serviceAccountName: vault-radar-agent
      automountServiceAccountToken: true
      containers:
        - name: vault-radar-agent
          image: docker.io/hashicorp/vault-radar:latest
          command: ["vault-radar"]
          args: ["agent", "exec"]
          imagePullPolicy: Always
          tty: true
          resources:
            limits:
              cpu: 1000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
          env:
            - name: HCP_PROJECT_ID
              value: <HCP_PROJECT_ID>
            - name: HCP_RADAR_AGENT_POOL_ID
              value: <HCP_RADAR_AGENT_POOL_ID>
            - name: HCP_CLIENT_ID
              value: <HCP_CLIENT_ID>
            - name: HCP_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: vault-radar-secrets
                  key: HCP_CLIENT_SECRET
            - name: VAULT_RADAR_GIT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: vault-radar-secrets
                  key: VAULT_RADAR_GIT_TOKEN

The example manifest is using Kubernetes Secrets for the sensitive credentials. This requires base64 encoding the values, and loading the secrets as environment variables on the pod(s). There are different ways you can configure the deployment as long as you set the environment variables vault-radar on the pod(s).

If you are using command line utilities to base64 encode the values, make sure to exclude the trailing newline character at the end of the input. For example, you can use the following command:

$ echo -n "<some value>" | base64

When deployed, each pod will output logs to stderr. You can tail the logs as you would any other Kubernetes pod using the kubectl command:

$ kubectl logs <pod name> -f

You will need to set environment variables for vault-radar substituting the actual values for the <PLACEHOLDERS>:

$ export HCP_PROJECT_ID=<HCP_PROJECT_ID>
$ export HCP_CLIENT_ID=<HCP_CLIENT_ID>
$ export HCP_CLIENT_SECRET=<HCP_CLIENT_SECRET>
$ export HCP_RADAR_AGENT_POOL_ID=<HCP_RADAR_AGENT_POOL_ID>

You can then start the agent by running:

$ vault-radar agent exec

Once configured, the agent will run in the foreground and log to stderr.