Blink enables seamless integration with a vault established within a customer’s personalized environment, guaranteeing secure management of connections within their controlled setting.
It’s important to note that Blink refrains from storing any confidential data, as it is exclusively maintained within the designated secret manager.
To configure a Self-Hosted Vault Secret Manager you need to start a self-hosted runner with additional configuration, including the vault URL and root token.
1

Create a New Runner in the Blink Platform

Create a new Runner in your workspace.
2

Access the Vault Server Using Vault URL and Root Token

Make sure you can access the vault server using vault URL and root token. Inside vault ensure that there is a secret engine (type kv mounted on path /secret). If it does not exist, define it in the vault UI by clicking Enable new engine.
3

Set the Runner Group as Default (Optional)

- Set new runner group as default for workspace. On the Runners page, click > Set as default.

ORSelect the checkbox Set as default in Add new runner group.
4

Copy the Runner Installation Command

To proceed, click on the ‘Continue’ button located in the bottom-right corner. This will prompt the opening of a dialogue box where you can access the command required to install the Runner in your environment. Simply copy this command to your clipboard by clicking on the icon positioned in the top-right corner.
5

Edit and Configure the Runner Command

Edit the command to add the environment variables: VAULT_URL, VAULT_ROOT_TOKEN and SECRET_MANAGER_TYPE.
docker run -d --name blink-runner -e VAULT_URL=<Vault URL> -e VAULT_ROOT_TOKEN=<Vault root token> -e SECRET_MANAGER_TYPE=vault -e CTRL_URL="https://app.blinkops.com" -e BLINK_RUNNER_CONFIG=/blink/config.yml --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock --add-host "host.docker.internal:host-gateway" blinkops/blink-runner: ./blink-runner -auth <API_KEY>

helm install -n blink --create-namespace --set image.tag=<version> --set secret.appKey=<Secret key> --set env.SECRET_MANAGER_TYPE=vault --set config.runner.ctrl_url=https://app.blinkops.com --set env.VAULT_URL=<Vault URL> --set env.VAULT_ROOT_TOKEN=<Vault root token>  blink-runner oci://public.ecr.aws/x9s7x6t7/blink-runner
When using the CloudFormation template, make sure to provide the OnPremVaultUrl and OnPremVaultRootToken parameters.
6

to ensure the runner has started successfully.

Note: The default workspace runner determines the storage location for new workspace connections. If the runner is configured with a self-hosted secret manager, the connections will be stored there. In the absence of a connected secret manager, the connections will be stored in Blink’s secret manager.
7

Verify Where the Connection is Being Stored

To verify where the connection is being stored look at the secret manager name below the connection name on the Connections page.
blink_cloud_sm indicates Blink’s secret manager. Anything else indicates customer’s self hosted secret manager.