1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
package vault
import (
"context"
"errors"
"time"
)
var (
ErrNotFound = errors.New("vault: not found (HTTP 404)")
ErrMountNotReady = errors.New("vault: the mount is not ready")
)
const (
CapabilityRead = "vault.read"
CapabilityWrite = "vault.write"
CapabilityLease = "vault.lease"
CapabilityPKIIssue = "vault.pki.issue"
TrustScope = "ca"
)
type KV interface {
Read(ctx context.Context, mount, path string, version int) (map[string]any, error)
Write(ctx context.Context, mount, path string, data map[string]any) error
Delete(ctx context.Context, mount, path string) error
}
type LeaseRequest struct {
Role string
TTL time.Duration
}
type Lease struct {
ID string
Role string
Renewable bool
ExpiresAt time.Time
}
type Leases interface {
Acquire(ctx context.Context, req LeaseRequest) (Lease, error)
Renew(ctx context.Context, id string, increment time.Duration) (Lease, error)
Revoke(ctx context.Context, id string) error
}
type PKI interface {
Issue(ctx context.Context, mount, role string, req CertRequest) (Cert, error)
CAChain(ctx context.Context, mount string) (string, error)
CA(ctx context.Context, mount string) (string, error)
}
type Trust interface {
CABundle(ctx context.Context) ([]byte, error)
Watch(fn func(bundle []byte)) (cancel func())
}
type Keys interface {
RotateKey(ctx context.Context, mount, name string) error
}
