openbao 0.2.0

Secure, typed, async Rust SDK for OpenBao
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

//! System policy and capability example.

use openbao::{
    Client, Result,
    sys::{MountEnableRequest, PolicyWriteRequest},
};
use secrecy::SecretString;
use std::collections::BTreeMap;

#[tokio::main]
async fn main() -> Result<()> {
    let token = std::env::var("BAO_TOKEN")
        .map(SecretString::from)
        .map_err(|error| {
            openbao::Error::InvalidHeader(format!(
                "BAO_TOKEN must be set for this example: {error}"
            ))
        })?;
    let client = Client::new("https://127.0.0.1:9940")?.with_token(token);

    let mut kv2_options = BTreeMap::new();
    kv2_options.insert("version".to_owned(), "2".to_owned());
    client
        .sys()
        .enable_mount(
            "example-secret",
            &MountEnableRequest {
                backend_type: "kv".to_owned(),
                description: Some("example KV v2 mount".to_owned()),
                config: None,
                options: kv2_options,
                local: Some(true),
                seal_wrap: None,
                external_entropy_access: None,
            },
        )
        .await?;

    client
        .sys()
        .write_policy(
            "example-app-read",
            &PolicyWriteRequest {
                policy: r#"path "example-secret/data/app" { capabilities = ["read"] }"#.to_owned(),
                expiration: None,
                ttl: Some("1h".to_owned()),
                cas: None,
                cas_required: None,
            },
        )
        .await?;

    let capabilities = client
        .sys()
        .capabilities_self(["example-secret/data/app"])
        .await?;
    let _path_capabilities = capabilities.by_path.get("example-secret/data/app");

    Ok(())
}