ChrisMacNaughton / vault-rs

https://docs.rs/hashicorp_vault
61 stars 27 forks source link

Complex secrets and secret metadata (e.g., lease IDs and TTLs) #7

Open emk opened 8 years ago

emk commented 8 years ago

At some point in the future, I'd also love to port https://github.com/emk/credentials and https://github.com/faradayio/credentials_to_env to use your vault-rs library instead of the dodgy, hand-rolled internal library that I use now.

To do this, I would need to add some new APIs to vault-rs:

  1. APIs for reading and writing compound secrets easily. These would correspond to vault secrets created like this:

    $ vault write secret/test user="foo" pass="bar"
    Success! Data written to: secret/test
    $ vault read secret/test
    Key                 Value
    ---                 -----
    refresh_interval    720h0m0s
    pass                bar
    user                foo

    Code using this API might hypothetically look something like:

    #[derive(RustcEncodable, RustcDecodable)]
    struct Secret {
       user: String,
       pass: String,
    }
    let secret: VaultResponse<Secret> = try!(client.get_secret_data("secret/test"));
  2. APIs for accessing the lease ID, TTL, etc. These could be accessed via the VaultResponse object, I believe, in the example above.

Do these features already exist anywhere in the current release (I didn't see them)? If not, would you be interested in receiving a PR adding APIs along these general lines? Please feel free to suggest better names, API improvements, etc.

Once again, thank you for maintaining this crate!

emk commented 8 years ago

(Just for future reference.) Implementing an API along these lines will allow us enable one of the tests added in #6.

ChrisMacNaughton commented 8 years ago

I quite like the idea of being able to deserialize data from Vault, as your example demonstrates.