Struct OpenBaoConfig 

pub struct OpenBaoConfig {
    pub address: String,
    pub auth: OpenBaoAuth,
    pub namespace: Option<String>,
    pub ca_cert: Option<String>,
    pub skip_verify: bool,
}

Available on crate feature secrets only.

OpenBao/Vault connection configuration.

Fields

address: String

Vault address (e.g., https://vault.example.com:8200).

auth: OpenBaoAuth

Authentication method.

namespace: Option<String>

Namespace (for Vault Enterprise).

ca_cert: Option<String>

TLS CA certificate path for Vault server.

skip_verify: bool

Skip TLS verification (not recommended for production).

Implementations

impl OpenBaoConfig

pub fn from_env() -> Option<Self>

Available on crate feature config only.

Load configuration from environment variables.

Uses standard VAULT_* environment variables with OPENBAO_* and BAO_* as legacy fallbacks (with deprecation warnings).

Environment Variables

• VAULT_ADDR - Vault/OpenBao server address
• VAULT_TOKEN - Authentication token (for token auth)
• VAULT_ROLE_ID + VAULT_SECRET_ID - AppRole authentication
• VAULT_K8S_ROLE - Kubernetes authentication role
• VAULT_NAMESPACE - Vault namespace (Enterprise)
• VAULT_CACERT - Path to CA certificate
• VAULT_SKIP_VERIFY - Skip TLS verification

Authentication Priority

1. If VAULT_TOKEN is set, uses token authentication
2. If VAULT_ROLE_ID and VAULT_SECRET_ID are set, uses AppRole
3. If VAULT_K8S_ROLE is set, uses Kubernetes authentication
4. Otherwise, returns an error

Errors

Returns None if VAULT_ADDR is not set or no authentication method can be determined.

pub fn with_token(address: &str, token: &str) -> Self

Create a configuration for token authentication.

pub fn with_approle(address: &str, role_id: &str, secret_id: &str) -> Self

Create a configuration for AppRole authentication.

pub fn with_namespace(self, namespace: &str) -> Self

Set the namespace (for Vault Enterprise).

pub fn with_ca_cert(self, path: &str) -> Self

Set the CA certificate path.

pub fn with_skip_verify(self) -> Self

Enable TLS skip verification (dev/test only – rejected in production by validate).

pub fn validate(&self, is_production: bool) -> Result<(), String>

Validate the Vault config against the deployment profile.

skip_verify disables TLS certificate verification, which exposes the connection to MITM. It is permitted only in dev/test; under a production profile this returns an error. Call at startup with crate::env::is_production.

NOTE: skip_verify is slated for removal at GA – private-CA trust via ca_cert (the unified TLS module) is the supported path.

Errors

Returns Err when is_production and skip_verify is set.

Trait Implementations

impl Clone for OpenBaoConfig

fn clone(&self) -> OpenBaoConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OpenBaoConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OpenBaoConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OpenBaoConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.