Struct Barrier 

pub struct Barrier<B: StorageBackend> { /* private fields */ }

Wraps a raw StorageBackend, transparently AEAD-encrypting/decrypting values. Paths are left in plaintext (same as Vault’s own barrier).

Implementations

impl<B: StorageBackend> Barrier<B>

pub fn new(inner: B, aead: Arc<dyn Aead>) -> Self

Trait Implementations

impl<B: StorageBackend> KeyRotation for Barrier<B>

fn rewrap_all<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = StorageResult<RewrapReport>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Rewraps every value not already sealed under the active key. Idempotent and safe to re-run: a second pass reports everything as unchanged.

fn active_key_id(&self) -> String

The active key’s derived id, so an operator can confirm which key a replica is actually sealing with.

impl<B: StorageBackend> StorageBackend for Barrier<B>

fn get<'life0, 'life1, 'async_trait>( &'life0 self, path: &'life1 str, ) -> Pin<Box<dyn Future<Output = StorageResult<Option<StorageEntry>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn put<'life0, 'life1, 'async_trait>( &'life0 self, path: &'life1 str, entry: StorageEntry, ) -> Pin<Box<dyn Future<Output = StorageResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn delete<'life0, 'life1, 'async_trait>( &'life0 self, path: &'life1 str, ) -> Pin<Box<dyn Future<Output = StorageResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn list<'life0, 'life1, 'async_trait>( &'life0 self, prefix: &'life1 str, ) -> Pin<Box<dyn Future<Output = StorageResult<Vec<String>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn ping<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = StorageResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Cheap liveness probe for the health endpoint. It must stay cheap: a load balancer calls it constantly, against every replica, forever.

fn list_expired<'life0, 'life1, 'async_trait>( &'life0 self, prefix: &'life1 str, now: DateTime<Utc>, ) -> Pin<Box<dyn Future<Output = StorageResult<Vec<String>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Paths under prefix whose expires_at has already passed.

fn replace_if_unchanged<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, path: &'life1 str, expected: &'life2 [u8], entry: StorageEntry, ) -> Pin<Box<dyn Future<Output = StorageResult<bool>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Replaces path’s value only if it still holds exactly expected, returning false when it changed underneath.

fn try_acquire_lock<'life0, 'life1, 'async_trait>( &'life0 self, key: &'life1 str, ) -> Pin<Box<dyn Future<Output = StorageResult<bool>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Best-effort cross-process mutual exclusion, so exactly one replica runs a singleton background task. Granting unconditionally is correct for a single-node or in-memory backend, which is why that is the default.