Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Model Vault

vault::Vault

Parameters

↳ const address: string
↳ const auth: string = "token"
↳ const auth_mount: string = ""
↳ const cache_ttl: u64 = 300
↳ const github_audience: string = ""
↳ const github_token: Secret<string> = <secret "env:MELODIUM_SECRET_ACTIONS_ID_TOKEN_REQUEST_TOKEN">
↳ const jwt: Secret<string> = <secret "env:MELODIUM_SECRET_VAULT_ID_TOKEN">
↳ const kubernetes_token: Secret<string> = <secret "file:/var/run/secrets/kubernetes.io/serviceaccount/token">
↳ const namespace: string = ""
↳ const prefetch: string = ""
↳ const role: string = ""
↳ const role_id: Secret<string> = <secret "env:MELODIUM_SECRET_VAULT_ROLE_ID">
↳ const secret_id: Secret<string> = <secret "env:MELODIUM_SECRET_VAULT_SECRET_ID">
↳ const source: string = "vault"
↳ const token: Secret<string> = <secret "env:MELODIUM_SECRET_VAULT_TOKEN">

HashiCorp Vault or OpenBao server, providing secrets.

The model registers a secret source named source, so that secrets located as vault:<path>#<field> are read from the server when revealed, such as vault:kv/data/app/db#password for the password field of the app/db key/value secret in a kv engine. The field can be omitted if the secret has only one.

  • address: address of the server, such as https://vault.example.com:8200.
  • source: name of the source, the scheme of locators (vault by default); two models with the same source, or a source named env or file, make the launch fail.
  • namespace: namespace to work in, if any.

Authentication is chosen by auth:

  • token: uses token as client token.
  • approle: logs in with role_id and secret_id.
  • kubernetes: logs in as role with the service account token kubernetes_token.
  • jwt: logs in as role with the jwt token, such as a GitLab CI ID token.
  • github: logs in as role with a GitHub Actions OIDC token, requested for the github_audience audience using github_token.

auth_mount is the path where the authentication method is enabled, by default approle, kubernetes or jwt (also for github).

Credentials are secrets, by default read from the usual environment variables, prefixed with MELODIUM_SECRET_ as programs only get those (MELODIUM_SECRET_VAULT_TOKEN, MELODIUM_SECRET_VAULT_ROLE_ID, MELODIUM_SECRET_VAULT_SECRET_ID, MELODIUM_SECRET_VAULT_ID_TOKEN, MELODIUM_SECRET_ACTIONS_ID_TOKEN_REQUEST_TOKEN), and from the Kubernetes service account token file. The model reveals them as vault::Vault, so they can be restricted to it with std/secret::|reveal_only_by.

Read secrets are kept for cache_ttl seconds (0 disables caching). prefetch lists the paths of secrets to read at startup, separated by spaces. Running with --check-secrets also reads the secrets given as parameters at startup.