Valensas Vault - Vault库

此库提供了一个方便的接口来与Vault交互。它允许身份认证、密钥管理以及令牌续订。

用法

有关详细信息，请访问： https://docs.rs/valensas-vault 仓库： https://github.com/Valensas/rust-vault

安装

将以下内容添加到您的 Cargo.toml 文件中

[dependencies]
valensas-vault = "0.2.3"

lib.rs:

此库提供了一个方便的接口来与Vault交互。它允许身份认证、密钥管理以及令牌续订。

安装

将以下内容添加到您的 Cargo.toml 文件中

[dependencies]
valensas-vault = "0.2.3"

功能

仅支持KV v2密钥引擎的操作。可以使用令牌或Kubernetes身份验证进行身份验证。

用法

手动配置

根据需要创建VaultConfig和AuthMethod

 let config = VaultConfig {
     address: "https://127.0.0.1:8200".to_string(),
     mount_path: "asd".to_string(),
     client_timeout: std::time::Duration::from_secs(10),
     healthcheck_file_path: "/healthcheck".to_string(),
     login_retry_count: 10,
 };
 let auth_method: Arc<RwLock<dyn AuthMethod>> = Arc::new(RwLock::new(TokenAuth::new("some_token".to_string())));

从配置和身份验证方法创建VaultService

let vault_service = VaultService::new(config, Arc::clone(&auth_method)).await.unwrap();

环境配置

以下环境变量用于配置VaultService

 VAULT_ADDR: "https://127.0.0.1:8200"
 VAULT_MOUNT_PATH: secret
 VAULT_HEALTH_CHECK_FILE: healthcheck_file
 VAULT_CLIENT_TIMEOUT: 5s
 VAULT_LOGIN_RETRY_COUNT: 5

Kubernetes身份验证

VAULT_AUTH_METHOD: Kubernetes
VAULT_KUBERNETES_TOKEN_PATH: /var/run/secrets/kubernetes.io/serviceaccount/token

令牌身份验证

VAULT_AUTH_METHOD: Token
VAULT_TOKEN: vault_token

给定值是变量的默认值。请确保用您的变量替换Vault配置中的变量。

示例用法

use std::time::Duration;
use valensas_vault::service::{HealthCheckData, VaultService};
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize, Clone, PartialEq)]
struct TestData {
    name: String,
}

#[tokio::main]
async fn main() {
    let (vault_service, _auth_method) = VaultService::from_env().await.unwrap();

    // Write a secret to Vault
    let secret_key = "my-new-secret-key";
    let secret_value = TestData {
        name: "data".to_string(),
    };
    vault_service.insert(secret_key, secret_value).await.unwrap();
    println!("Secret inserted successfully.");

    // Read a secret from Vault
    let value = vault_service.read::<TestData>(secret_key).await.unwrap();
    println!("Secret read successfully.");
}

令牌续订

 use std::time::Duration;
 use valensas_vault::service::{VaultService, TokenRenewable};
 use tokio::sync::RwLock;
 use std::sync::Arc;

 #[tokio::main]
 async fn main() {
     // Initialize the Vault service
     let (vault_service, auth_method) = VaultService::from_env().await.unwrap();

     let vault_service = Arc::new(RwLock::new(vault_service));

     // Start token renewal
     let handler = vault_service.start_token_renewal(auth_method);

     // Perform some operations...
     // ...

     // Stop token renewal
     // handler may be none in case if auth method is Kubernetes
     if let Ok(Some(token_renewal_handler)) = handler {
         vault_service.stop_token_renew_loop(token_renewal_handler).await;
     }
 }