Class HashiCorpVaultProvider

HashiCorp Vault (KV v2) provider.

Since

0.1.0

Implements

SecretProvider

Index

Constructors

Methods

connect disconnect get isHealthy isReady set

Constructors

constructor

new HashiCorpVaultProvider(
options?: HashiCorpVaultProviderOptions,
): HashiCorpVaultProvider
Parameters
- Optionaloptions: HashiCorpVaultProviderOptions
  Vault connection/injection options
Returns HashiCorpVaultProvider

Throws
When requestTimeoutMs is out of range
- Defined in packages/secrets-plugin/src/providers/vault.ts:216

Methods

connect

connect(): Promise<void>
Establishes any backing connection/client. No-op for stateless providers.

Returns Promise<void>
Implementation of SecretProvider.connect
- Defined in packages/secrets-plugin/src/providers/vault.ts:229

disconnect

disconnect(): Promise<void>
Releases any backing connection/client. No-op for stateless providers.

Returns Promise<void>
Implementation of SecretProvider.disconnect
- Defined in packages/secrets-plugin/src/providers/vault.ts:247

get

get(name: string): Promise<string | null>
Reads a secret from Vault's KV v2 engine.
Parameters
- name: string
  The secret path (relative to the mount)
Returns Promise<string | null>
The value, or null when absent

Throws
When Vault cannot be reached or does not answer within requestTimeoutMs

Throws
On a non-404 HTTP error or a body that is not JSON
Implementation of SecretProvider.get
- Defined in packages/secrets-plugin/src/providers/vault.ts:265

isHealthy

isHealthy(): Promise<boolean>
Probes Vault's unauthenticated /v1/sys/health (M90b). Any HTTP response proves the server answered — Vault reports its standby and sealing states through STATUS CODES on this endpoint, all of which mean "reachable" — and a network failure does not. No secret is read and the auth token is not sent: the health endpoint is unauthenticated by design, and a read is not a probe.

Returns Promise<boolean>
true when the Vault server answers

Since
0.5.0
Implementation of SecretProvider.isHealthy
- Defined in packages/secrets-plugin/src/providers/vault.ts:330

isReady

isReady(): boolean
Reports whether the provider is ready to serve reads.

Returns boolean
Implementation of SecretProvider.isReady
- Defined in packages/secrets-plugin/src/providers/vault.ts:252

set

set(name: string, value: string): Promise<void>
Writes a new secret version to Vault's KV v2 engine.
Parameters
- name: string
  The secret path (relative to the mount)
- value: string
  The new value
Returns Promise<void>

Throws
When Vault cannot be reached or does not answer within requestTimeoutMs

Throws
On any HTTP error
Implementation of SecretProvider.set
- Defined in packages/secrets-plugin/src/providers/vault.ts:301