hashicorp Vault

A Zilla runtime hashicorp vault that wraps and unwraps per-message field-encryption keys using the HashiCorp Vault Transit secrets engine, so the raw key material never leaves Vault.

This is typically referenced by a Kafka model's field-level encryption transform, so each message's data-encryption key is wrapped by Vault before the record is produced, and unwrapped by Vault to decrypt on read.

Available in Zilla Plus

The tls option, when present, sources client identity and/or trusted certificate authority material from another named vault — for example a filesystem vault — so this vault can reach an internal Vault server behind a private certificate authority, or present a client certificate for mutual TLS. When omitted, connections use the JVM's default trust store.

hashicorp0:
  type: hashicorp
  options:
    endpoint: https://vault.example.com
    credentials:
      token: ${{env.VAULT_TOKEN}}
    keys:
      orders-key: transit/keys/orders

Configuration (* required)

options

object

The hashicorp specific options.

options.endpoint

string

Base URL of the HashiCorp Vault server, e.g. https://vault.example.com.

options.credentials

object

Authentication material for the Vault server.

options:
  credentials:
    token: ${{env.VAULT_TOKEN}}

credentials.token

string

Vault token sent as the X-Vault-Token header on every request. Typically sourced from an environment variable via ${{env.NAME}} interpolation rather than checked into configuration. When omitted, requests are sent with no X-Vault-Token header.

options.tls

object

Client-side TLS material for the connection to the Vault server, sourced from another named vault in the same namespace.

options:
  tls:
    vault: tls0
    keys:
      - client
    trust:
      - vault-ca

tls.vault*

string

Name of another vault in the same namespace to resolve client identity and/or trust material from.

tls.keys

array of string

Client identity aliases to resolve from the referenced vault, for mutual TLS. When omitted, every key the referenced vault holds is resolved.

tls.trust

array of string

Trusted certificate authority aliases to resolve from the referenced vault, for a Vault server certificate issued by a private certificate authority. When omitted, every trust entry the referenced vault holds is resolved.

options.keys

array of string, object

Map of alias name to the Transit key's path, addressed by HashiCorp Vault's own <mount>/keys/<name> convention. Accepts either a list of paths or a map of alias name to path, so an alias can be referenced by name wherever a path would otherwise be required.

options:
  keys:
    orders-key: transit/keys/orders

When no alias is needed, a bare list of paths can be given instead — each path doubles as its own alias:

options:
  keys:
    - transit/keys/orders

The Transit secrets engine can be mounted at more than one path — for example to separate keys by tenant or compliance boundary — so the full <mount>/keys/<name> path is required to address a key under a non-default mount. For a key under the default transit mount, the mount and /keys/ segment can be omitted, so orders-key: orders resolves identically to orders-key: transit/keys/orders.