Struct VaultClient 

pub struct VaultClient { /* private fields */ }

A connection to the secret store.

Cheap to clone — the token is shared, so re-authenticating in one place is visible everywhere, which is what a background renewer needs.

Implementations

impl VaultClient

pub async fn login(&self, method: &dyn Login) -> Result<Lease>

Log in, keep the token, and return the lease it came with.

The lease is the point: a service that logs in once at boot and never looks at the lease again will stop working somewhere between an hour and a month later, at a time nobody chose.

pub async fn lookup_self(&self) -> Result<Lease>

What the current token’s lease is, according to the server.

Its TTL lives in data.ttl rather than the lease_duration every other response uses, so this cannot go through VaultResponse::lease.

impl VaultClient

pub fn new(address: impl Into<String>) -> VaultClient

Point at a store: https://vault.internal:8200.

pub fn from_env() -> Result<VaultClient>

Read the address and token from the environment, the way every Vault and OpenBao tool does: VAULT_ADDR/BAO_ADDR, VAULT_TOKEN/BAO_TOKEN.

Reading the environment rather than a config file is deliberate — a token in .env is a token in a file somebody will eventually commit.

pub fn namespace(self, namespace: impl Into<String>) -> VaultClient

pub fn timeout(self, timeout: Duration) -> VaultClient

pub fn retries(self, retries: u32) -> VaultClient

How many times to retry a request that failed in a way retrying can fix.

pub fn faking(self, fake: Fake) -> VaultClient

Answer from a script instead of the network, for tests.

pub fn address(&self) -> &str

pub fn fake(&self) -> Option<&Arc<Fake>>

The script this client is answering from, for assertions in a test.

pub fn set_token(&self, token: impl Into<String>)

pub fn token(&self) -> String

pub fn clear_token(&self)

Forget the token — after revoking it, so a later call fails as “no token” rather than silently reusing a dead one.

pub fn has_token(&self) -> bool

pub fn url(&self, path: &str) -> String

The full URL for an API path, which is always under /v1/.

Leading slashes are trimmed so secret/data/x and /secret/data/x both work — the difference is invisible in a config file and produces a 404 that looks like a missing secret.

pub async fn get(&self, path: &str) -> Result<VaultResponse>

pub async fn post(&self, path: &str, body: Json) -> Result<VaultResponse>

pub async fn delete(&self, path: &str) -> Result<VaultResponse>

pub async fn patch(&self, path: &str, body: Json) -> Result<VaultResponse>

A PATCH, which KV v2 uses to change some fields and leave the rest.

Sent as application/merge-patch+json, which is not a detail: Vault answers a PATCH declaring plain application/json with a 415, and the error says nothing about content types.

pub async fn list(&self, path: &str) -> Result<VaultResponse>

A LIST, which Vault spells as a query parameter rather than a method, because not every proxy in the world forwards a LIST verb.

pub async fn get_optional(&self, path: &str) -> Result<Option<VaultResponse>>

Like VaultClient::get, but a missing path is None rather than an error — reading a secret that may not exist yet is ordinary.

impl VaultClient

pub fn database(&self) -> DatabaseSecrets<'_>

The database secrets engine at the default database/ mount.

impl VaultClient

pub fn kv(&self) -> Kv<'_>

The KV v2 engine at the default secret/ mount.

impl VaultClient

pub async fn renew_lease( &self, lease: &Lease, increment: Option<Duration>, ) -> Result<Lease>

Ask for more time on a lease.

The increment is a request, not an instruction: Vault caps it at the role’s max TTL and answers with what it actually gave, which is why the renewed lease has to come from the response rather than from the argument. Renewing a lease that has already lapsed fails — there is nothing left to extend, and the account is already gone.

pub async fn revoke_lease(&self, lease: &Lease) -> Result<()>

End a lease now, deleting whatever it was holding open.

Idempotent: Vault answers 204 for a lease it has never heard of, so a shutdown path that revokes twice does not need to care.

pub async fn lookup_lease(&self, lease_id: &str) -> Result<Lease>

What Vault currently thinks of a lease.

The honest way to find out whether a credential is still alive, as opposed to asking the local Lease, which only knows what it was told when it was issued.

pub async fn renew_token(&self, increment: Option<Duration>) -> Result<Lease>

Ask for more time on the current token.

The call a long-running service makes on a timer. Losing the token loses access to every secret behind it, so this failing is worth an alert rather than a log line.

pub async fn revoke_token(&self) -> Result<()>

Give up the current token, and forget it.

Worth calling on a clean shutdown: a token that outlives the process it was issued for is a credential nobody is watching. The token is cleared here as well, so a later request fails as “no token” rather than as a 403 that looks like a policy problem.

Trait Implementations

impl Clone for VaultClient

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VaultClient

Deliberately hand-written so the token cannot reach a log.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl SecretSource for VaultClient

fn read<'a>(&'a self, path: &'a str) -> BoxFuture<'a, Result<Secret>>