Tooark.Secrets.Vault 4.7.0

Tooark.Secrets.Vault

Tooark.Secrets provider on HashiCorp Vault and OpenBao: it loads the KV version 2 secrets into IConfiguration and implements ISecretService on them. OpenBao keeps the Vault API, so the same package serves both.

The client is the package's own, on the HTTP API, without a third-party library: it covers reading and listing the KV and authentication by token, AppRole or Kubernetes.

The model, the common options and the conversion of names into keys are in the Tooark.Secrets README. This README covers what is specific to Vault.

🌍 Languages: 🇺🇸 English (this file) · 🇧🇷 Português

📑 Contents

• Installation
• Configuration
• Authentication
• Access policy
• Behavior on Vault
• Dependencies
• Error Codes and Solutions
• Contributing
• Help & Security
• Support
• License

🔧 Installation

dotnet add package Tooark.Secrets.Vault

⚙️ Configuration

appsettings.json

{
  "Secrets": {
    "Address": "https://vault.company.com:8200",
    "Path": "arkuest/prod",
    "AuthMethod": "Kubernetes",
    "Role": "arkuest"
  }
}

Program.cs

using Tooark.Secrets.Vault.Injections;

// KV secrets in the configuration, on top of appsettings.json
builder.Configuration.AddTooarkSecretsVault();

// Runtime secret reads, with cache
builder.Services.AddTooarkSecretsVault(builder.Configuration);

The IConfigurationBuilder AddTooarkSecretsVault requires Path. The IServiceCollection one registers ISecretService, which reads any KV path.

VaultSecretsOptions properties

Besides the common options:

A missing address, token and namespace come from the command-line client's environment variables: first VAULT_*, then BAO_*. A value set in the configuration wins over them.

🔑 Authentication

The AppRole and Kubernetes token is obtained on first use. When the store rejects it, because it expired or was revoked, the client logs in again and repeats the request once. The Token method's token is not renewed.

🔒 Access policy

The identity's policy needs to read the secrets and list the path's folders:

path "secret/data/arkuest/prod/*" {
  capabilities = ["read"]
}

path "secret/data/arkuest/prod" {
  capabilities = ["read"]
}

path "secret/metadata/arkuest/prod/*" {
  capabilities = ["list"]
}

path "secret/metadata/arkuest/prod" {
  capabilities = ["list"]
}

🧭 Behavior on Vault

• One field, one key — the SecretKey field of the secret arkuest/prod/Storage becomes Storage:SecretKey; the fields of the secret at Path itself sit at the root.
• Recursive read — Path is walked folder by folder, up to 10 levels. A path that is both a secret and a folder has both read.
• JSON fields — a field's value stays as text, even when it is JSON, unless ExpandJson. A field that is not text (number, object) arrives in JSON format.
• Current version — the current version of each secret applies; a deleted secret is skipped.
• ISecretService — the name is the KV path, and the value is the JSON object with the fields; GetFieldAsync reads one field.

📋 Dependencies

There is no third-party client: the calls to the store use the .NET HttpClient.

⚠️ Error Codes and Solutions

The common errors are in the Tooark.Secrets README. A failure to load the source arrives as Secrets.LoadFailed;Vault, with the store error in InnerException.

🤝 Contributing

Contributions are welcome! Start with CONTRIBUTING.md — it covers the development workflow, the coding and commit conventions and the pull request checklist. Bugs and feature requests go through the issue templates of the Tooark repository.

By participating you agree to the Code of Conduct.

🆘 Help & Security

• ❓ Questions, bugs, feature ideas — see SUPPORT.md for the right channel
• 🔒 Security vulnerabilities — do not open a public issue; follow SECURITY.md

💖 Support

If Tooark helps your projects, consider supporting its development:

• 💙 GitHub Sponsors
• ☕ Ko-fi

Every contribution helps keep the project maintained and improving. Thank you! 🙏

📄 License

This project is licensed under the BSD 3-Clause License.