vault

Documentation

Overview

Example: HashiCorp Vault provider.

Models the runtime config of a checkout service: log level, request timeout, a rate limit, a maintenance feature flag, a database connection struct, and a list of allowed CORS origins. The whole config lives in a single KV v2 secret at "secret/checkout", and each registered key maps to a field of that secret, so one Vault read per poll cycle covers everything. Struct and array values are stored as JSON strings.

Run it end to end:

docker compose up -d
docker compose exec vault vault kv put secret/checkout \
  log_level=info \
  request_timeout=30s \
  rate_limit_rps=100 \
  maintenance_mode=false \
  database='{"host":"db.internal","port":5432,"max_open_conns":20}' \
  allowed_origins='["https://app.example.com"]'
go run main.go

Then change a value and watch the app log the event:

docker compose exec vault vault kv patch secret/checkout rate_limit_rps=500 maintenance_mode=true