Vault.Extension.Configuration 0.2.2

Vault.Extension.Configuration

A configuration extension for Microsoft.Extensions.Configuration that integrates with HashiCorp Vault using VaultSharp

Features

• 🔐 Multiple authentication methods: Local token, AWS IAM, or custom authentication
• ⚙️ Seamless integration with Microsoft.Extensions.Configuration
• 🔄 Secret loading into configuration at startup
• ✅ Fluent validation for configuration options
• 🏗️ Dependency injection support

Installation

dotnet add package Vault.Extension.Configuration

Quick Start

Basic Usage with Local Token

var builder = WebApplication.CreateBuilder(args);

builder.AddVault(options =>
{
    options.AuthenticationType = VaultAuthenticationType.Local;
    options.Configuration = new VaultLocalConfiguration
    {
        VaultUrl = "https://vault.example.com",
        MountPoint = "secret",
        TokenFilePath = "~/.vault-token"
    };
}, environment: "production");

var app = builder.Build();

AWS IAM Authentication

builder.AddVault(options =>
{
    options.AuthenticationType = VaultAuthenticationType.AWS_IAM;
    options.Configuration = new VaultAwsConfiguration
    {
        VaultUrl = "https://vault.example.com",
        MountPoint = "secret",
        Environment = "production",
        AwsAuthMountPoint = "aws",
        AwsIamRoleName = "my-app-role" // Optional, defaults to {MountPoint}-{Environment}-role
    };
}, environment: "production");

Custom Authentication

For authentication methods not natively supported (AppRole, LDAP, UserPass, etc.):

builder.AddVault(options =>
{
    options.AuthenticationType = VaultAuthenticationType.Custom;
    options.Configuration = new VaultDefaultConfiguration
    {
        VaultUrl = "https://vault.example.com",
        MountPoint = "secret"
    };
    options.CustomAuthMethodInfo = new AppRoleAuthMethodInfo(roleId, secretId);
}, environment: "production");

Configuration Options

VaultOptions

VaultLocalConfiguration

VaultAwsConfiguration

Advanced Usage

Using IVaultService Directly

public class MyService
{
    private readonly IVaultService _vaultService;

    public MyService(IVaultService vaultService)
    {
        _vaultService = vaultService;
    }

    public async Task<string> GetSecretAsync(string key)
    {
        var secretValue = await _vaultService.GetSecretValueAsync("production", key);
        return secretValue?.ToString() ?? throw new InvalidOperationException($"Secret '{key}' not found");
    }

    public async Task<Dictionary<string, object>> GetAllSecretsAsync()
    {
        return await _vaultService.GetSecretsAsync("production");
    }
}

Loading Secrets with Prefix

builder.AddVault(options => { /* ... */ },
    environment: "production",
    sectionPrefix: "MyApp",
    addUnregisteredEntries: true);

Requirements

• .NET 8.0 or later
• HashiCorp Vault server
• VaultSharp (included as dependency)

License

This project is licensed under the MIT License - see the LICENSE file for details.

Contributing

See CONTRIBUTING.md for guidelines.

Template Information

<details> <summary>Click to expand template documentation</summary>

This project is based on Library.Template.

Build Features

• Auto-versioning via Nerdbank.GitVersioning
• Static analyzers: Code Analysis and StyleCop
• Read-only source tree (builds to top-level bin/obj folders)
• Builds with a "pinned" .NET SDK for reproducible builds
• Testing on Windows, Linux and macOS

Maintaining your repo based on this template

git fetch
git checkout origin/main
.\tools\MergeFrom-Template.ps1
# resolve any conflicts, then commit the merge commit.
git push origin -u HEAD

</details>