Expand description
rustlavel-vault: secrets from OpenBao or HashiCorp Vault.
One package for both. OpenBao is a fork of Vault from before the licence changed to BUSL, and the HTTP API is the same one — nothing here compiles against either project, so neither licence reaches your binary.
The point is to stop a database password living in .env. A file on disk
is a file that gets copied into a backup, a container image, a screenshot
and eventually a repository. A secret fetched at boot lives in memory, and a
dynamic one — an account the store creates for this process and deletes
when the lease ends — cannot be replayed from a leaked backup at all.
Written from scratch on the published HTTP API, over rustlavel-client.
Re-exports§
pub use auth::AppRole;pub use auth::Kubernetes;pub use auth::Login;pub use auth::Token;pub use auth::UserPass;pub use client::VaultClient;pub use client::VaultResponse;pub use database::DatabaseCredentials;pub use database::DatabaseSecrets;pub use kv::Kv;pub use kv::Secret as KvSecret;pub use kv::SecretMetadata;pub use error::VaultError;pub use fake::Fake;pub use fake::FakeVault;pub use lease::Lease;pub use plugin::Vault;pub use renew::Renewer;pub use resolve::Resolver;pub use resolve::Secret;pub use resolve::SecretRef;pub use resolve::SecretSource;
Modules§
- auth
- Proving who you are to Vault.
- client
- Talking to OpenBao or HashiCorp Vault.
- database
- Database accounts that expire on their own.
- error
- What a secret store says when it says no.
- fake
Vault::fake()— a secret store that answers from a script.- kv
- The KV version 2 engine: static secrets, kept in versions.
- lease
- Leases: secrets that stop working if nobody renews them.
- leases
- Keeping a grant alive, and ending it early.
- plugin
- Turning the secret store on.
- renew
- Keeping leases alive in the background.
- resolve
- Secrets that arrive as configuration.
Enums§
- Error
- Every failure the framework itself can produce.
Type Aliases§
- Result
- The framework-wide result type.