Struct SecretsManager 

pub struct SecretsManager {
    pub cache: Arc<RwLock<HashMap<String, String>>>,
    /* private fields */
}

Vault-based secrets manager

Fields

cache: Arc<RwLock<HashMap<String, String>>>

Cache of loaded API keys (provider_id -> api_key)

Implementations

impl SecretsManager

pub async fn new(config: &VaultConfig) -> Result<Self>

Create a new secrets manager with Vault configuration

pub async fn from_k8s_auth( address: &str, role: &str, mount: &str, kv_mount: Option<&str>, kv_path: Option<&str>, ) -> Result<Self>

Authenticate to Vault using the pod’s Kubernetes service account JWT.

Reads the SA JWT from the standard Kubernetes mount path (overridable via VAULT_K8S_SA_JWT_PATH) then calls the Vault auth/kubernetes/login endpoint. The returned manager holds the short-lived token that Vault issued — no VAULT_TOKEN environment variable is required.

pub async fn from_env() -> Result<Self>

Try to create from environment (for initial bootstrap only).

When VAULT_ROLE is set the worker authenticates via Kubernetes service account — no static token is needed and the resulting Vault token is short-lived and automatically rotated by Vault itself. Falls back to VAULT_TOKEN when VAULT_ROLE is absent or K8s auth fails.

pub fn is_connected(&self) -> bool

Check if Vault is configured and connected

pub async fn get_api_key(&self, provider_id: &str) -> Result<Option<String>>

Get an API key for a provider from Vault

pub async fn get_provider_secrets( &self, provider_id: &str, ) -> Result<Option<ProviderSecrets>>

Get all secrets for a provider

pub async fn set_provider_secrets( &self, provider_id: &str, secrets: &ProviderSecrets, ) -> Result<()>

Set/update secrets for a provider in Vault

pub async fn has_api_key(&self, provider_id: &str) -> bool

Check if a provider has an API key in Vault

pub async fn list_configured_providers(&self) -> Result<Vec<String>>

List all providers that have secrets configured

pub async fn clear_cache(&self)

Clear the cache (useful when secrets are rotated)

Trait Implementations

impl Clone for SecretsManager

fn clone(&self) -> SecretsManager

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for SecretsManager

fn default() -> Self

Returns the “default value” for a type.