vault

Vault Client Library

A comprehensive HashiCorp Vault client library for Go applications that provides:

• Easy configuration management via YAML files
• Multiple authentication methods (Token, AppRole)
• Dynamic database credential management
• Keycloak credential retrieval
• Crypto key management
• Automatic lease renewal

Installation

go get github.com/Danextle/vault-client

Usage

Basic Setup

package main

import (
    "context"
    "log"
    
    vault "github.com/yourusername/vault-client"
)

func main() {
    // Initialize vault client with config file
    client, err := vault.NewVaultClient("config.yaml")
    if err != nil {
        log.Fatal(err)
    }
    
    // Get database credentials
    ctx := context.Background()
    dbCreds, err := client.GetDatabaseCredentials(ctx)
    if err != nil {
        log.Fatal(err)
    }
    
    log.Printf("Database credentials: %+v", dbCreds)
}

Configuration File Format

Create a config.yaml file:

vault:
  address: "https://vault.example.com:8200"
  authMethod: "approle"  # or "token"
  approleRoleID: "your-role-id"
  approleSecretID: "your-secret-id"
  databaseSecretsPath: "database/creds/my-role"
  # For token auth:
  # token: "your-vault-token"

Database Configuration

For database configuration, create a separate db-config.yaml:

database:
  postgresql:
    host: "localhost"
    port: "5432"
    dbname: "mydb"
    sslmode: "disable"
    enableLog: "true"
    maxIdleConns: 10
    maxOpenConns: 100
    connMaxLifetime: 3600

Features

Authentication

• Token Authentication: Direct token-based auth
• AppRole Authentication: Role-based authentication for applications

Credential Management

• Dynamic Database Credentials: Fetch time-limited PostgreSQL credentials
• Keycloak Integration: Retrieve Keycloak admin and client credentials
• Crypto Keys: Secure retrieval of encryption keys
• Lease Renewal: Automatic credential lease management

Configuration

• YAML Configuration: Easy-to-manage configuration files
• Flexible Structure: Support for multiple configuration formats

API Reference

Types

• VaultClient: Main client for interacting with Vault
• Config: Application configuration structure
• VaultConfig: Vault-specific configuration
• DatabaseCredentials: Database connection credentials
• KeycloakCredentials: Keycloak service credentials

Methods

• NewVaultClient(configFile string) (*VaultClient, error)
• GetDatabaseCredentials(ctx context.Context) (*DatabaseCredentials, error)
• GetKeycloakCredentials(ctx context.Context) (*KeycloakCredentials, error)
• GetCryptoKey(ctx context.Context) (string, error)
• RenewDatabaseCredentials(ctx context.Context, leaseID string) error
• LoadConfig(filename string) (*Config, error)
• LoadDbConfig(filename string) (*DbConfig, error)

Requirements

• Go 1.19+
• HashiCorp Vault server
• Access to configured Vault policies

License

MIT License - see LICENSE file for details