Skip to main content
The Azure Key Vault secret provider connects the Orchestrator to Azure Key Vault for cloud-native secrets and certificate management. This provider authenticates using Microsoft Entra ID service principal credentials, making it suitable for Orchestrator deployments in any environment with Microsoft Entra ID access.
Console terminology: In the Maverics Console, Orchestrator instances and configuration delivery are managed through Deployments. When working directly with YAML, configuration is managed as files delivered via the -config flag or MAVERICS_CONFIG environment variable.

​
Overview

When configured with the Azure Key Vault provider, the Orchestrator authenticates to Azure using OAuth 2.0 Client Credentials with a service principal and pre-populates all enabled secrets from the specified Key Vault instance at startup. Azure Key Vault stores secrets, certificates, and cryptographic keys — all accessible through the same provider configuration.

​
Use Cases

  • Azure-native secret and certificate storage — store and manage Orchestrator secrets and TLS certificates in Key Vault with native Azure integration
  • Centralized secret management — manage all Orchestrator secrets in a single Key Vault with access policies and audit logging
  • Key rotation — leverage Azure Key Vault’s versioning to rotate secrets and pick up new versions on Orchestrator restart

​
Configuration

Secret providers are not configured in YAML. They are set via the MAVERICS_SECRET_PROVIDER environment variable or the -secretProvider CLI flag.

​
Configuration via Environment Variable

export MAVERICS_SECRET_PROVIDER="azurekeyvault://my-vault.vault.azure.net?clientID=<client-id>&clientSecret=<client-secret>&tenantID=<tenant-id>"

​
Configuration via CLI Flag

maverics -config maverics.yaml -secretProvider "azurekeyvault://my-vault.vault.azure.net?clientID=<client-id>&clientSecret=<client-secret>&tenantID=<tenant-id>"

​
Referencing Secrets in YAML

Once the secret provider is configured, reference secrets in your Orchestrator YAML configuration using angle bracket syntax. The key in the angle brackets maps to the secret name in the Key Vault: 
connectors:
  - name: my-idp
    oauthClientSecret: <my-client-secret>
At startup, the provider pre-populates all enabled secrets from the Key Vault. Secret names in the angle brackets must match the secret names stored in Azure Key Vault.

​
Configuration Reference

​
URL Structure

azurekeyvault://{vault-name}.vault.azure.net?clientID={id}&clientSecret={secret}&tenantID={tenant}

​
URL Parameters

ParameterRequiredDescription
Vault hostnameYesThe full hostname of the Azure Key Vault (e.g., my-vault.vault.azure.net)
clientIDYesMicrosoft Entra ID application (service principal) client ID
clientSecretYesMicrosoft Entra ID application client secret
tenantIDYesMicrosoft Entra ID tenant ID
entraIDHostNoMicrosoft Entra ID authentication host. Defaults to login.microsoftonline.com.

​
Authentication

The provider authenticates to Azure using the OAuth 2.0 Client Credentials flow with the service principal credentials provided in the URL query parameters. It requests a token from the Entra ID token endpoint (https://{entraIDHost}/{tenantID}/oauth2/v2.0/token) scoped to the Key Vault.

​
Troubleshooting

“Unauthorized” or “403 Forbidden” when starting the Orchestrator Verify that the clientID, clientSecret, and tenantID query parameters are correct. Ensure the service principal has the Get and List permissions for secrets in the Key Vault access policy (or the Key Vault Secrets User RBAC role if using Azure RBAC). OAuth token errors Check that the tenantID is correct and that the service principal has not expired. If using a custom entraIDHost, verify it is reachable from the Orchestrator host. “VaultNotFound” error Confirm the vault hostname is correct and that the Key Vault exists in the expected Azure subscription. The hostname must include .vault.azure.net. Secrets not resolving in YAML configuration Ensure the angle bracket syntax matches the secret names in the Key Vault. The provider pre-populates all enabled secrets at startup — only enabled secrets are available.

Secret Providers

Overview of all secret providers

AWS Secrets Manager

Cloud-native secrets for AWS deployments