Vault
- Canonical Telco
| Channel | Revision | Published | Runs on |
|---|---|---|---|
| latest/edge | 89 | 31 Jan 2024 | |
| latest/edge | 9 | 27 Jan 2023 | |
| 1.16/stable | 280 | 04 Oct 2024 | |
| 1.16/candidate | 280 | 04 Oct 2024 | |
| 1.16/beta | 280 | 04 Oct 2024 | |
| 1.16/edge | 313 | 20 Dec 2024 | |
| 1.15/stable | 248 | 24 Jul 2024 | |
| 1.15/candidate | 248 | 24 Jul 2024 | |
| 1.15/beta | 248 | 24 Jul 2024 | |
| 1.15/edge | 248 | 10 Jul 2024 |
juju deploy vault-k8s --channel 1.16/stable
Deploy Kubernetes operators easily with Juju, the Universal Operator Lifecycle Manager. Need a Kubernetes cluster? Install MicroK8s to create a full CNCF-certified Kubernetes system in under 60 seconds.
Platform:
charms.vault_k8s.v0.vault_client
-
- Last updated 02 Dec 2024
- Revision Library version 0.23
Library for interacting with a Vault cluster.
This library shares operations that interact with Vault through its API. It is intended to be used by charms that need to manage a Vault cluster.
Index
class LogAdapter
Description
Adapter for the logger to prepend a prefix to all log lines. None
Methods
LogAdapter. process( self , msg , kwargs )
Description
Decides the format for the prepended text. None
class Token
Class that represents token authentication for vault.
Description
This method is the most basic and always available method to access vault.
Methods
Token. login( self , client )
Description
Authenticate a vault client with a token. None
class AppRole
Class that represents approle authentication for vault.
Description
This method is primarily used to authenticate automation programs for vault.
Methods
AppRole. login( self , client )
Description
Authenticate a vault client with approle details. None
class AuthMethod
Description
Classes that implement a login method are auth methods used to log in to Vault. None
Methods
AuthMethod. login( self , client )
Description
Log in using the given method. None
class Certificate
Description
Class that represents a certificate generated by the PKI secrets engine. None
class AuditDeviceType
Description
Class that represents the devices that vault supports as device types for audit. None
class SecretsBackend
Description
Class that represents the supported secrets backends by Vault. None
class VaultClientError
Description
Base class for exceptions raised by the Vault client. None
class VaultClient
Description
Class to interact with Vault through its API. None
Methods
VaultClient. __init__( self , url: str , ca_cert_path )
VaultClient. authenticate( self , auth_details: AuthMethod )
Find and use the token related with the given auth method.
Returns
True if the authentication was successful and the token was accepted by vault.
VaultClient. token( self )
Description
Return the token used to authenticate with Vault. None
VaultClient. is_api_available( self )
Description
Return whether Vault is available. None
VaultClient. is_initialized( self )
Description
Return whether Vault is initialized. None
VaultClient. is_sealed( self )
Description
Return whether Vault is sealed. None
VaultClient. read( self , path: str )
Description
Read the data at the given path. None
VaultClient. write( self , path: str , data: dict )
Description
Write the data at the given path. None
VaultClient. list( self , path: str )
Description
List the keys at the given path. None
VaultClient. needs_migration( self )
Description
Return true if the vault needs to be migrated, false otherwise. None
VaultClient. get_seal_type( self )
Description
Return the seal type of the Vault. None
VaultClient. is_seal_type_transit( self )
Description
Return whether Vault is sealed by the transit backend. None
VaultClient. is_active( self )
Return whether the Vault node is active or not.
Returns
True if initialized, unsealed and active, False otherwise.
VaultClient. is_active_or_standby( self )
Return the health status of Vault.
Returns
True if initialized, unsealed and active or standby, False otherwise.
VaultClient. enable_audit_device( self , device_type: AuditDeviceType , path: str )
Enable a new audit device at the supplied path if it isn't already enabled.
Arguments
One of three available device types
The path that will receive audit logs
VaultClient. enable_approle_auth_method( self )
Description
Enable approle auth method if it isn't already enabled. None
VaultClient. create_or_update_policy_from_file( self , name: str , path: str )
Create/update a policy within vault, using the file contents as the policy.
Arguments
Name of the policy to create
The path of the file where the policy is defined, ending with .hcl
Additional arguments to format the policy
VaultClient. create_or_update_policy( self , name: str , content: str )
Create/update a policy within vault.
Arguments
Name of the policy to create
The policy content
VaultClient. create_or_update_approle( self , name: str , token_ttl , token_max_ttl , policies , cidrs , token_period )
Create/update a role within vault associating the supplied policies.
Arguments
Name of the role to be created or updated
The attached list of policy names this approle will have access to
Incremental lifetime for generated tokens, provided as a duration string such as "5m"
Maximum lifetime for generated tokens, provided as a duration string such as "5m"
The period within which the token must be renewed. See Vault documentation for more information.
The list of IP networks that are allowed to authenticate
VaultClient. generate_role_secret_id( self , name: str , cidrs )
Description
Generate a new secret tied to an AppRole. None
VaultClient. read_role_secret( self , name: str , id: str )
Description
Get definition of a secret tied to an AppRole. None
VaultClient. enable_secrets_engine( self , backend_type: SecretsBackend , path: str )
Description
Enable given secret engine on the given path. None
VaultClient. disable_secrets_engine( self , path: str )
Description
Disable the secret engine at the given path. None
VaultClient. get_intermediate_ca( self , mount: str )
Description
Get the intermediate CA for the PKI backend. None
VaultClient. import_ca_certificate_and_key( self , mount: str , certificate: str , private_key: str )
Description
Import the CA certificate and private key for the PKI backend. None
VaultClient. sign_pki_certificate_signing_request( self , mount: str , role: str , csr: str , common_name: str , ttl: str )
Sign a certificate signing request for the PKI backend.
Arguments
The PKI mount point.
The role to use for signing the certificate.
The certificate signing request.
The common name for the certificate.
The relative validity for the certificate. Should be a string in the format of a number with a unit such as "120m", "10h" or "90d".
Returns
The signed certificate object
VaultClient. create_or_update_pki_charm_role( self , role: str , allowed_domains: str , max_ttl: str , mount: str )
Create a role for the PKI backend or update it if it already exists.
Arguments
The name of the role to create or update.
The list of allowed domains for the role.
The maximum TTL for the role. It is also used by Vault as a maximum validity for the certificates issued by this role. Should be a string in the format of a number with a unit such as "120m", "10h" or "90d".
The mount point of the PKI backend for which the role will be created.
VaultClient. is_pki_role_created( self , role: str , mount: str )
Description
Check if the role is created for the PKI backend. None
VaultClient. create_snapshot( self )
Description
Create a snapshot of the Vault data. None
VaultClient. restore_snapshot( self , snapshot: IOBase )
Restore a snapshot of the Vault data.
Description
Uses force_restore_raft_snapshot to restore the snapshot even if the unseal key used at backup time is different from the current one.
VaultClient. get_raft_cluster_state( self )
Description
Get raft cluster state. None
VaultClient. is_raft_cluster_healthy( self )
Description
Check if raft cluster is healthy. None
VaultClient. remove_raft_node( self , id: str )
Description
Remove raft peer. None
VaultClient. is_node_in_raft_peers( self , id: str )
Description
Check if node is in raft peers. None
VaultClient. get_num_raft_peers( self )
Description
Return the number of raft peers. None
VaultClient. is_common_name_allowed_in_pki_role( self , role: str , mount: str , common_name: str )
Description
Return whether the provided common name is in the list of domains allowed by the specified PKI role. None
VaultClient. get_role_max_ttl( self , role: str , mount: str )
Description
Get the max ttl for the specified PKI role in seconds. None
VaultClient. make_latest_pki_issuer_default( self , mount: str )
Description
Update the issuers config to always make the latest issuer created default issuer. None
VaultClient. create_transit_key( self , mount_point: str , key_name: str )
Description
Create a new key in the transit backend. None
VaultClient. delete_role( self , name: str )
Description
Delete the approle with the given name. None
VaultClient. delete_policy( self , name: str )
Description
Delete the policy with the given name. None
def
generate_pem_bundle(
certificate: str,
private_key: str
)
Description
Generate a PEM bundle from a certificate and private key. None