vaultix v0.9.0 Vaultix.Client
Provides a functionality to authenticate and read from a vault endpoint.
Link to this section Summary
Functions
Authenticates with vault using a tuple. This can be executed before attempting to read secrets from vault
Returns a specification to start this module under a supervisor
Deletes a secret to Vault given a path
Invoked when the server is started. start_link/3
or start/3
will
block until it returns
Reads a secret from vault given a path
Writes a secret to Vault given a path
Link to this section Functions
auth( method :: :approle, credentials :: {role_id :: String.t(), secret_id :: String.t()}, timeout :: String.t() | nil ) :: {:ok | :error, any()}
auth( method :: :app_id, credentials :: {app_id :: String.t(), user_id :: String.t()}, timeout :: String.t() | nil ) :: {:ok | :error, any()}
auth( method :: :userpass, credentials :: {username :: String.t(), password :: String.t()}, timeout :: String.t() | nil ) :: {:ok | :error, any()}
auth( method :: :github, credentials :: {github_token :: String.t()}, timeout :: String.t() | nil ) :: {:ok | :error, any()}
auth( method :: :token, credentials :: {token :: String.t()}, timeout :: String.t() | nil ) :: {:ok, :authenticated}
Authenticates with vault using a tuple. This can be executed before attempting to read secrets from vault.
Parameters
- method: Auth backend to use for authenticating, can be one of
:approle, :app_id, :userpass, :github, :token
- credentials: A tuple or map used for authentication depending on the method,
{role_id, secret_id}
for:approle
,{app_id, user_id}
for:app_id
,{username, password}
for:userpass
,{github_token}
for:github
,{token}
for:token
, or json-encodable map for unhandled methods, i.e.%{jwt: "jwt", role: "role"}
for:kubernetes
- timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply
Examples
iex> Vaultix.Client.auth(:approle {role_id, secret_id}, 5000)
{:ok, :authenticated}
iex> Vaultix.Client.auth(:app_id, {app_id, user_id})
{:ok, :authenticated}
iex> Vaultix.Client.auth(:userpass, {username, password})
{:error, ["Something didn't work"]}
iex> Vaultix.Client.auth(:github, {github_token})
{:ok, :authenticated}
iex> Vaultix.Client.auth(:jwt, %{jwt: jwt, role: role})
{:ok, :authenticated}
Returns a specification to start this module under a supervisor.
See Supervisor
.
Deletes a secret to Vault given a path.
Parameters
- key: A String path where the secret will be deleted.
- auth_method and credentials: See Vaultix.Client.auth
- timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply
Examples
iex> Vaultix.Client.delete("secret/foo", :app_role, {role_id, secret_id}, 5000)
:ok
iex> Vaultix.Client.delete("secret/foo", :app_id, {app_id, user_id})
:ok
Invoked when the server is started. start_link/3
or start/3
will
block until it returns.
args
is the argument term (second argument) passed to start_link/3
.
Returning {:ok, state}
will cause start_link/3
to return
{:ok, pid}
and the process to enter its loop.
Returning {:ok, state, timeout}
is similar to {:ok, state}
except handle_info(:timeout, state)
will be called after timeout
milliseconds if no messages are received within the timeout.
Returning {:ok, state, :hibernate}
is similar to {:ok, state}
except the process is hibernated before entering the loop. See
c:handle_call/3
for more information on hibernation.
Returning {:ok, state, {:continue, continue}}
is similar to
{:ok, state}
except that immediately after entering the loop
the c:handle_continue/2
callback will be invoked with the value
continue
as first argument.
Returning :ignore
will cause start_link/3
to return :ignore
and
the process will exit normally without entering the loop or calling
c:terminate/2
. If used when part of a supervision tree the parent
supervisor will not fail to start nor immediately try to restart the
GenServer
. The remainder of the supervision tree will be started
and so the GenServer
should not be required by other processes.
It can be started later with Supervisor.restart_child/2
as the child
specification is saved in the parent supervisor. The main use cases for
this are:
- The
GenServer
is disabled by configuration but might be enabled later. - An error occurred and it will be handled by a different mechanism than the
Supervisor
. Likely this approach involves callingSupervisor.restart_child/2
after a delay to attempt a restart.
Returning {:stop, reason}
will cause start_link/3
to return
{:error, reason}
and the process to exit with reason reason
without
entering the loop or calling c:terminate/2
.
Callback implementation for GenServer.init/1
.
Reads a secret from vault given a path.
Parameters
- key: A String path to be used for querying vault.
- auth_method and credentials: See Vaultix.Client.auth
- timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply
Examples
iex> Vaultix.Client.read("secret/foobar", :approle, {role_id, secret_id}, 5000)
{:ok, %{"value" => "bar"}}
iex> Vaultix.Client.read("secret/foo", :app_id, {app_id, user_id})
{:ok, %{"value" => "bar"}}
iex> Vaultix.Client.read("secret/baz", :userpass, {username, password})
{:error, ["Key not found"]}
iex> Vaultix.Client.read("secret/bar", :github, {github_token})
{:ok, %{"value" => "bar"}}
iex> Vaultix.Client.read("secret/bar", :plugin_defined_auth, credentials)
{:ok, %{"value" => "bar"}}
Writes a secret to Vault given a path.
Parameters
- key: A String path where the secret will be written.
- value: A String => String map that will be stored in Vault
- auth_method and credentials: See Vaultix.Client.auth
- timeout: A integer greater than zero which specifies how many milliseconds to wait for a reply
Examples
iex> Vaultix.Client.write("secret/foo", %{"value" => "bar"}, :app_role, {role_id, secret_id}, 5000)
:ok
iex> Vaultix.Client.write("secret/foo", %{"value" => "bar"}, :app_id, {app_id, user_id})
:ok