vaultix v0.9.0 Vaultix.Client

Provides a functionality to authenticate and read from a vault endpoint.

Link to this section Summary

Functions

Authenticates with vault using a tuple. This can be executed before attempting to read secrets from vault

Returns a specification to start this module under a supervisor

Deletes a secret to Vault given a path

Invoked when the server is started. start_link/3 or start/3 will block until it returns

Reads a secret from vault given a path

Writes a secret to Vault given a path

Link to this section Functions

Link to this function auth(method, credentials, timeout \\ 5000)
auth(
  method :: :approle,
  credentials :: {role_id :: String.t(), secret_id :: String.t()},
  timeout :: String.t() | nil
) :: {:ok | :error, any()}
auth(
  method :: :app_id,
  credentials :: {app_id :: String.t(), user_id :: String.t()},
  timeout :: String.t() | nil
) :: {:ok | :error, any()}
auth(
  method :: :userpass,
  credentials :: {username :: String.t(), password :: String.t()},
  timeout :: String.t() | nil
) :: {:ok | :error, any()}
auth(
  method :: :github,
  credentials :: {github_token :: String.t()},
  timeout :: String.t() | nil
) :: {:ok | :error, any()}
auth(
  method :: :token,
  credentials :: {token :: String.t()},
  timeout :: String.t() | nil
) :: {:ok, :authenticated}

Authenticates with vault using a tuple. This can be executed before attempting to read secrets from vault.

Parameters

  • method: Auth backend to use for authenticating, can be one of :approle, :app_id, :userpass, :github, :token
  • credentials: A tuple or map used for authentication depending on the method, {role_id, secret_id} for :approle, {app_id, user_id} for :app_id, {username, password} for :userpass, {github_token} for :github, {token} for :token, or json-encodable map for unhandled methods, i.e. %{jwt: "jwt", role: "role"} for :kubernetes
  • timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply

Examples

iex> Vaultix.Client.auth(:approle {role_id, secret_id}, 5000)
{:ok, :authenticated}

iex> Vaultix.Client.auth(:app_id, {app_id, user_id})
{:ok, :authenticated}

iex> Vaultix.Client.auth(:userpass, {username, password})
{:error, ["Something didn't work"]}

iex> Vaultix.Client.auth(:github, {github_token})
{:ok, :authenticated}

iex> Vaultix.Client.auth(:jwt, %{jwt: jwt, role: role})
{:ok, :authenticated}
Link to this function child_spec(arg)

Returns a specification to start this module under a supervisor.

See Supervisor.

Link to this function delete(key, auth_method, credentials, timeout \\ 5000)

Deletes a secret to Vault given a path.

Parameters

  • key: A String path where the secret will be deleted.
  • auth_method and credentials: See Vaultix.Client.auth
  • timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply

Examples

iex> Vaultix.Client.delete("secret/foo", :app_role, {role_id, secret_id}, 5000)
:ok

iex> Vaultix.Client.delete("secret/foo", :app_id, {app_id, user_id})
:ok

Invoked when the server is started. start_link/3 or start/3 will block until it returns.

args is the argument term (second argument) passed to start_link/3.

Returning {:ok, state} will cause start_link/3 to return {:ok, pid} and the process to enter its loop.

Returning {:ok, state, timeout} is similar to {:ok, state} except handle_info(:timeout, state) will be called after timeout milliseconds if no messages are received within the timeout.

Returning {:ok, state, :hibernate} is similar to {:ok, state} except the process is hibernated before entering the loop. See c:handle_call/3 for more information on hibernation.

Returning {:ok, state, {:continue, continue}} is similar to {:ok, state} except that immediately after entering the loop the c:handle_continue/2 callback will be invoked with the value continue as first argument.

Returning :ignore will cause start_link/3 to return :ignore and the process will exit normally without entering the loop or calling c:terminate/2. If used when part of a supervision tree the parent supervisor will not fail to start nor immediately try to restart the GenServer. The remainder of the supervision tree will be started and so the GenServer should not be required by other processes. It can be started later with Supervisor.restart_child/2 as the child specification is saved in the parent supervisor. The main use cases for this are:

  • The GenServer is disabled by configuration but might be enabled later.
  • An error occurred and it will be handled by a different mechanism than the Supervisor. Likely this approach involves calling Supervisor.restart_child/2 after a delay to attempt a restart.

Returning {:stop, reason} will cause start_link/3 to return {:error, reason} and the process to exit with reason reason without entering the loop or calling c:terminate/2.

Callback implementation for GenServer.init/1.

Link to this function read(key, auth_method, credentials, timeout \\ 5000)

Reads a secret from vault given a path.

Parameters

  • key: A String path to be used for querying vault.
  • auth_method and credentials: See Vaultix.Client.auth
  • timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply

Examples

iex> Vaultix.Client.read("secret/foobar", :approle, {role_id, secret_id}, 5000)
{:ok, %{"value" => "bar"}}

iex> Vaultix.Client.read("secret/foo", :app_id, {app_id, user_id})
{:ok, %{"value" => "bar"}}

iex> Vaultix.Client.read("secret/baz", :userpass, {username, password})
{:error, ["Key not found"]}

iex> Vaultix.Client.read("secret/bar", :github, {github_token})
{:ok, %{"value" => "bar"}}

iex> Vaultix.Client.read("secret/bar", :plugin_defined_auth, credentials)
{:ok, %{"value" => "bar"}}
Link to this function write(key, value, auth_method, credentials, timeout \\ 5000)

Writes a secret to Vault given a path.

Parameters

  • key: A String path where the secret will be written.
  • value: A String => String map that will be stored in Vault
  • auth_method and credentials: See Vaultix.Client.auth
  • timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply

Examples

iex> Vaultix.Client.write("secret/foo", %{"value" => "bar"}, :app_role, {role_id, secret_id}, 5000)
:ok

iex> Vaultix.Client.write("secret/foo", %{"value" => "bar"}, :app_id, {app_id, user_id})
:ok