Summary
The provider currently supports overriding the Akeyless API URL at runtime via the AKEYLESS_API_URL environment variable (see InitClient in akeyless-pam/AkeylessPam.cs), falling back to the Url initialization parameter, falling back to the default https://api.akeyless.io.
The integration test harness (tests/AkeylessPam.Integration.Tests/) already relies on a broader set of environment variables to configure the auth credentials it feeds into the provider under test:
AKEYLESS_ACCESS_IDAKEYLESS_ACCESS_KEYAKEYLESS_AUTH_TYPEAKEYLESS_API_URL (already supported in production)
Today, AccessId, AccessKey, and AuthType can only be set via the manifest.json InitializationInfo block or the Command portal PAM provider configuration — there's no env var override path for them in the shipped provider, only in the test harness.
Request
Extend the same environment-variable-override pattern already used for AKEYLESS_API_URL to the remaining connection parameters, so the production provider supports:
| Env var |
Overrides |
Falls back to |
AKEYLESS_API_URL |
Url |
default https://api.akeyless.io (existing behavior) |
AKEYLESS_ACCESS_ID |
AccessId |
configured AccessId |
AKEYLESS_ACCESS_KEY |
AccessKey |
configured AccessKey |
AKEYLESS_AUTH_TYPE |
AuthType |
configured AuthType |
This lets deployments control Akeyless connection details at the infrastructure/deployment level (e.g. process environment, secrets injection) instead of only via manifest.json or the Command portal, matching the flexibility already exercised by the test harness.
Notes
- Precedence should mirror the existing
AKEYLESS_API_URL behavior: env var, if set, wins over the configured parameter.
AccessId/AccessKey are credential-bearing — no logging changes needed beyond what's already redacted, but double check nothing new gets logged.- Update
docsource/akeyless.md (source for generated docs) to document all four env vars as a configuration mode alongside manifest.json, not just AKEYLESS_API_URL.
Summary
The provider currently supports overriding the Akeyless API URL at runtime via the
AKEYLESS_API_URLenvironment variable (seeInitClientinakeyless-pam/AkeylessPam.cs), falling back to theUrlinitialization parameter, falling back to the defaulthttps://api.akeyless.io.The integration test harness (
tests/AkeylessPam.Integration.Tests/) already relies on a broader set of environment variables to configure the auth credentials it feeds into the provider under test:AKEYLESS_ACCESS_IDAKEYLESS_ACCESS_KEYAKEYLESS_AUTH_TYPEAKEYLESS_API_URL(already supported in production)Today,
AccessId,AccessKey, andAuthTypecan only be set via themanifest.jsonInitializationInfoblock or the Command portal PAM provider configuration — there's no env var override path for them in the shipped provider, only in the test harness.Request
Extend the same environment-variable-override pattern already used for
AKEYLESS_API_URLto the remaining connection parameters, so the production provider supports:AKEYLESS_API_URLUrlhttps://api.akeyless.io(existing behavior)AKEYLESS_ACCESS_IDAccessIdAccessIdAKEYLESS_ACCESS_KEYAccessKeyAccessKeyAKEYLESS_AUTH_TYPEAuthTypeAuthTypeThis lets deployments control Akeyless connection details at the infrastructure/deployment level (e.g. process environment, secrets injection) instead of only via
manifest.jsonor the Command portal, matching the flexibility already exercised by the test harness.Notes
AKEYLESS_API_URLbehavior: env var, if set, wins over the configured parameter.AccessId/AccessKeyare credential-bearing — no logging changes needed beyond what's already redacted, but double check nothing new gets logged.docsource/akeyless.md(source for generated docs) to document all four env vars as a configuration mode alongsidemanifest.json, not justAKEYLESS_API_URL.