vault

type AppRole struct {
	// Engine is the authentication engine path
	//
	// Hashicorp Vault allows multiple engines of the
	// same type mounted at the same time and/or engines
	// mounted at arbitrary paths.
	Engine string

	// ID is the AppRole authentication ID
	ID string

	// Secret is the AppRole authentication secret.
	Secret string

	// Retry is the duration after which another
	// authentication attempt is performed once
	// an authentication attempt failed.
	Retry time.Duration
}

type Config struct {
	// Endpoint is the HTTP Vault server endpoint
	Endpoint string

	// Engine is the path of the K/V engine to use.
	//
	// Vault allows multiple engines of the same type
	// mounted at the same time and/or engines mounted
	// at arbitrary paths.
	Engine string

	// APIVersion is the API version of the K/V engine.
	//
	// If empty, it defaults to APIv1.
	//
	// Ref: https://www.vaultproject.io/docs/secrets/kv
	APIVersion string

	// The Vault namespace used to separate and isolate different
	// organizations / tenants at the same Vault instance. If
	// non-empty, the Vault client will send the
	//   X-Vault-Namespace: Namespace
	// HTTP header on each request.
	//
	// Ref: https://www.vaultproject.io/docs/enterprise/namespaces/index.html
	Namespace string

	// Prefix is the key prefix on Vault's K/V store
	// similar to a directory. Keys will be fetched
	// from and stored within this prefix.
	Prefix string

	// AppRole contains the Vault AppRole authentication
	// credentials.
	AppRole *AppRole

	// K8S contains the Vault Kubernetes authentication
	// credentials.
	K8S *Kubernetes

	// Transit contains an optional Vault transit engine
	// configuration for en/decrypting keys at the K/V
	// engine. It adds an additional layer of encryption.
	Transit *Transit

	// StatusPingAfter is the duration after which
	// the KeyStore will check the status of the Vault
	// server. Particularly, this status information
	// is used to determine whether the Vault server
	// has been sealed resp. unsealed again.
	StatusPingAfter time.Duration

	// Path to the mTLS client private key to authenticate to
	// the Vault server.
	PrivateKey string

	// Path to the mTLS client certificate to authenticate to
	// the Vault server.
	Certificate string

	// Path to the root CA certificate(s) used to verify the
	// TLS certificate of the Vault server. If empty, the
	// host's root CA set is used.
	CAPath string
	// contains filtered or unexported fields
}

type Kubernetes struct {
	// Engine is the authentication engine path
	//
	// Hashicorp Vault allows multiple engines of the
	// same type mounted at the same time and/or engines
	// mounted at arbitrary paths.
	Engine string

	// Role is the JWT role.
	Role string

	// JWT is the issued authentication token.
	JWT string

	// Retry is the duration after which another
	// authentication attempt is performed once
	// an authentication attempt failed.
	Retry time.Duration
}

type Store struct {
	// contains filtered or unexported fields
}

type Transit struct {
	// Engine is the transit engine path.
	// If empty, defaults to EngineTransit.
	Engine string

	// KeyName is the name of the transit key
	// used for en/decrypting K/V entries.
	KeyName string
}