Enum Auth 

#[non_exhaustive]
pub enum Auth {
    Token(String),
    AppRole {
        mount: String,
        role_id: String,
        secret_id: String,
    },
    Kubernetes {
        mount: String,
        role: String,
        token_path: String,
    },
    Jwt {
        mount: String,
        role: Option<String>,
        jwt: String,
    },
    Userpass {
        mount: String,
        username: String,
        password: String,
    },
    Ldap {
        mount: String,
        username: String,
        password: String,
    },
    Certificate {
        mount: String,
        name: Option<String>,
    },
}

How to obtain a Vault token.

The variants that take a mount take the auth method’s mount path, which is its type by default — approle for AppRole, kubernetes for Kubernetes. Mounting the same method twice under different paths is ordinary Vault practice, which is why it is a parameter rather than a constant.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Token(String)

A token somebody already obtained.

The simplest thing that works, and the only one that cannot recover on its own: there are no credentials here to log in again with. A renewable token is still renewed.

AppRole

AppRole: a role id and a secret id.

The usual choice for a service outside Kubernetes.

Fields

mount: String

Mount path, "approle" by default.

role_id: String

The role’s public half.

secret_id: String

The role’s secret half.

Kubernetes

Kubernetes: the pod’s service-account token, plus a Vault role.

The JWT is read from disk at every login rather than once, because the kubelet rotates projected service-account tokens and a copy taken at startup expires with the pod still running.

Fields

mount: String

Mount path, "kubernetes" by default.

role: String

The Vault role to assume.

token_path: String

Where the service-account token is mounted.

Jwt

A JWT or OIDC token, with an optional role.

Fields

mount: String

Mount path, "jwt" by default.

role: Option<String>

The Vault role, when the mount does not have a default.

jwt: String

The token to present.

Userpass

Username and password against the userpass method.

Fields

mount: String

Mount path, "userpass" by default.

username: String

The user to log in as.

password: String

Their password.

Ldap

Username and password against an LDAP directory.

Fields

mount: String

Mount path, "ldap" by default.

username: String

The user to log in as.

password: String

Their password.

Certificate

A TLS client certificate, with an optional role.

The certificate itself is configured on the HTTP client, not here: build a ureq::Agent that presents it and hand it over with Vault::with_agent. This variant only says log in with it, which is the part Vault needs told.

Fields

mount: String

Mount path, "cert" by default.

name: Option<String>

The certificate role, when the mount does not pick one by subject.

Implementations

impl Auth

pub fn token(token: impl Into<String>) -> Self

A token somebody already obtained.

pub fn app_role( role_id: impl Into<String>, secret_id: impl Into<String>, ) -> Self

AppRole, on the default approle mount.

pub fn kubernetes(role: impl Into<String>) -> Self

Kubernetes, on the default kubernetes mount, reading the pod’s own service-account token.

pub fn jwt(jwt: impl Into<String>) -> Self

A JWT or OIDC token, on the default jwt mount.

pub fn userpass( username: impl Into<String>, password: impl Into<String>, ) -> Self

Username and password, on the default userpass mount.

pub fn ldap(username: impl Into<String>, password: impl Into<String>) -> Self

Username and password against LDAP, on the default ldap mount.

pub fn certificate() -> Self

A TLS client certificate, on the default cert mount.

pub fn at_mount(self, path: impl Into<String>) -> Self

Puts this method on a different mount path.

No effect on Auth::Token, which has no mount.

pub fn with_role(self, role: impl Into<String>) -> Self

Names the role, for the methods that take one.

pub fn with_token_path(self, path: impl Into<String>) -> Self

Reads the service-account token from somewhere other than the conventional path.

Trait Implementations

impl Clone for Auth

fn clone(&self) -> Auth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Auth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.