397 - HashiCorp Vault support for database secrets #398
Conversation
First edition of HashiCorp Vault support
oracle-contributor-agreement
bot
added
the
OCA Verified
| Connects client to Vault backend, need to handle different connection methods in the future | ||
| */ | ||
| promLogConfig := &promslog.Config{} | ||
| logger := promslog.New(promLogConfig) |
There was a problem hiding this comment.
please use the provided *slog.Logger, if necessary move logging statements higher in the stack or pass the *slog.Logger down the stack
There was a problem hiding this comment.
if not possible, what you're doing is fine
|
|
||
| result := map[string]string{} | ||
| var err error | ||
| if mountType == "kvv2" || mountType == "kvv1" { |
There was a problem hiding this comment.
is there a vault const for these?
There was a problem hiding this comment.
No, these are just strings I made up. Vault has multiple plugins to handle secrets, "kvv1" and "kvv2" are the simplest key-value secret stores. I'll also soon work on adding the "database" secret store type. They all need slightly different SDK calls.
| @@ -0,0 +1,53 @@ | |||
| package hashivault | |||
There was a problem hiding this comment.
If this is an integration test, it must live in another package/project - otherwise go test of this project will fail when the user doesn't have an external vault.
|
See comments, mainly formatting. Could use modify the vault test to use a stand-in or remove it? |
|
And thank you for the contribution! |
Some style fixes based on PR comments
|
This is all looking good, except for the test file. If you could either add a HashiVault stand-in or remove the file I think it's ready to merge. |
Thank you, I'll do some final changes and push them when I get the opportunity to test in a few days. |
2 participants
Signed-off-by: Ilmar Kerm [email protected]
Support HashiCorp Vault secret store for database credentials.
📌 Description
This is a first release for supporting HashiCorp Vault for database login credentials. First release supports connecting to Vault Proxy via Unix socket and fetching secrets from key-value stores.
✅ Checklist
🔗 Related Issue
#397