Struct VaultEnvelope 

pub struct VaultEnvelope { /* private fields */ }

A KeyEnvelope backed by Vault’s Transit engine: wrap/ unwrap are transit/encrypt|decrypt/<key> round-trips, so the KEK never leaves Vault and every cluster node unwraps through the same service (no shared local key file). Any KMS exposing a Vault-compatible Transit API works. The token is passed in from the environment (never stored in config files).

Implementations

impl VaultEnvelope

pub fn new(addr: &str, key: &str, token: String) -> Self

Configure against addr (e.g. https://vault:8200), Transit key key, and a Vault token.

Trait Implementations

impl KeyEnvelope for VaultEnvelope

fn wrap<'life0, 'life1, 'async_trait>( &'life0 self, plaintext: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EnvelopeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Wrap plaintext, returning an opaque blob to store at rest.

fn unwrap<'life0, 'life1, 'async_trait>( &'life0 self, wrapped: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EnvelopeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Unwrap a blob produced by wrap, returning the plaintext.