vaultx

README

vaultx

vaultx is an alternative to the official Vault Go package that is designed with the developer in mind.

The official Vault package is very useful, but it has a number of issues that make it difficult to integrate Vault into your applications:

• Tied tightly to the HTTP API, making accomplishing basic functionality involve writing expansive blocks of code
• Types are very generic, so you lose out on type safety and must know the HTTP API in order interact with it
• Automatic renewal of authentication credentials is not well-supported

vaultx seeks to address these issues and make Vault a joy to use in Go.

Usage

To create your vault client, create a new configuration struct and pass it to vaultx's New() function:

package main

import (
	"context"
	"fmt"
	"os"

	"github.com/jaredpetersen/vaultx"
	vaultxauth "github.com/jaredpetersen/vaultx/auth"
)

const k8sRole = "my-app"
const vaultKVSecretPath = "my-secret"
const vaultTransitKey = "transit-key"

func main() {
	ctx := context.Background()

	cfg := vaultx.NewConfig("https://vault.mydomain.com")
	cfg.Auth.Method = vaultxauth.NewKubernetesMethod(vaultxauth.KubernetesConfig{Role: k8sRole})

	vltx := vaultx.New(cfg)

	err := vltx.Auth().Login(ctx)
	if err != nil {
		fmt.Println("Failed to authenticate against Vault")
		os.Exit(1)
	}

	// Store secret
	secretData := map[string]interface{}{
		"username": "dbuser",
		"password": "3hvu2ZLxwauHrNaZjJbJARHE",
	}
	err = vltx.KV().UpsertSecret(ctx, vaultKVSecretPath, secretData)
	if err != nil {
		fmt.Println("Failed to store secret")
		os.Exit(1)
	}

	// Get secret
	secret, err := vltx.KV().GetSecret(ctx, vaultKVSecretPath)
	if err != nil {
		fmt.Println("Failed to retrieve secret")
		os.Exit(1)
	}

	fmt.Printf("secret username: %s\n", secret.Data["username"])
	fmt.Printf("secret password: %s\n", secret.Data["password"])

	// Encrypt data
	plaintext := "encrypt me"
	encrypted, err := vltx.Transit().Encrypt(ctx, vaultTransitKey, []byte(plaintext))
	if err != nil {
		fmt.Println("Failed to encrypt data")
		os.Exit(1)
	}

	fmt.Printf("encrypted: %s\n", encrypted)

	// Decrypt data
	decrypted, err := vltx.Transit().Decrypt(ctx, vaultTransitKey, encrypted)
	if err != nil {
		fmt.Println("Failed to decrypt data")
		os.Exit(1)
	}

	fmt.Printf("decrypted: %s\n", string(decrypted))
}

Install

go get github.com/jaredpetersen/vaultx

Sponsorship

If you or your company uses vaultx, please consider contributing to the project via GitHub Sponsors. There's some cool work that we'd like to do -- like end-to-end integration tests -- but cloud computing isn't free.

Documentation

Index

• type AuthConfig
• type Client
  • func New(config Config) *Client
  • func (c *Client) API() *api.Client
  • func (c *Client) Auth() *auth.Client
  • func (c *Client) DB() *db.Client
  • func (c *Client) KV() *kv.Client
  • func (c *Client) Transit() *transit.Client
• type Config
  • func NewConfig(url string) Config
• type HTTPConfig

Types

type AuthConfig

type AuthConfig struct {
	Method auth.Method
}

AuthConfig describes how the Client should be configured in regard to authentication.

type Client

type Client struct {
	// Config configures how the Vault client will interact with Vault.
	Config *Config
	// contains filtered or unexported fields
}

Client is a resource for interacting with Vault.

func New

func New(config Config) *Client

New creates a new Vault client.

func (*Client) API

func (c *Client) API() *api.Client

API is a direct client to the Vault HTTP engine, enabling manual execution against Vault.

func (*Client) Auth

func (c *Client) Auth() *auth.Client

Auth is a gateway into Vault authentication.

See https://www.vaultproject.io/api-docs/auth for more information.

func (*Client) DB

func (c *Client) DB() *db.Client

DB is a gateway into the database secrets engine.

For more information, see https://www.vaultproject.io/docs/secrets/databases.

func (*Client) KV

func (c *Client) KV() *kv.Client

KV is a gateway into the key-value secrets engine.

For more information, see https://www.vaultproject.io/docs/secrets/kv.

func (*Client) Transit

func (c *Client) Transit() *transit.Client

Transit is a gateway into the transit secrets engine.

For more information, see https://www.vaultproject.io/docs/secrets/transit.

type Config

type Config struct {
	URL  string
	HTTP HTTPConfig
	Auth AuthConfig
}

Config describes how the Client should be configured.

func NewConfig

func NewConfig(url string) Config

NewConfig creates a new configuration struct with some helpful defaults.

type HTTPConfig

type HTTPConfig struct {
	Timeout time.Duration
}

HTTPConfig describes how the HTTP client should be configured.