Struct DatabaseSecrets 

pub struct DatabaseSecrets<'a> { /* private fields */ }

The database secrets engine at one mount.

Implementations

impl<'a> DatabaseSecrets<'a>

pub fn mount(self, mount: impl Into<String>) -> DatabaseSecrets<'a>

The same engine mounted elsewhere.

pub async fn credentials(&self, role: &str) -> Result<DatabaseCredentials>

A new account for a role, created on the spot.

Each call makes a different account. Calling it per query rather than per process will fill the database with roles and exhaust whatever connection limit it has, so hold the result for the life of the lease.

pub async fn rotate_root(&self, name: &str) -> Result<()>

Change the password Vault itself uses to reach the database.

Worth doing right after the engine is configured: until it runs, the root password is whatever an operator typed into a terminal, and afterwards it is a value only Vault has ever seen. It is one-way — there is no call that reads the new password back — so an operator who needs superuser access again has to reset it out of band.

pub async fn static_credentials( &self, role: &str, ) -> Result<DatabaseCredentials>

The credentials for a static role: an account that already exists and whose password Vault rotates on a schedule.

Unlike DatabaseSecrets::credentials this returns the same username every time, and the lease is only how long until the next rotation.