Add Support of Hashicorp Vault into Helidon

[ak98neon]

Please add support of Hashicorp Vault https://www.vaultproject.io/ into Helidon Framework.

[tomas-langer]

Hello, could you please describe the use case - esp. what you expect from Helidon.
I can see an integration as a config source - so you could inject @ConfigProperty into CDI beans with configuration obtained from the Vault.

If you have ideas how this could work, we would welcome them. If not, we will choose the mode of integration as we see fit, which may not be aligned with the use case(s) you have.

Thanks a lot!

[maheshmuthulankkat]

Hi,
I have given below some of our use cases related to Hashicorp Vault. We currently use Spring vault.

1. Connect to vault and retrieve secrets. Interface something similar to Spring vault VaultVersionedKeyValueOperations.
2. Core vault interaction. Interface something similar to Spring vault VaultTemplate
3. Kubernetes based authentication to vault. Details at https://docs.spring.io/spring-vault/docs/current/reference/html/#vault.authentication.kubernetes

[vipinjnair]

Hi,

It would be great if a Vault Rest based client be added to the Helidon package.

Listing out some Vault use cases that we are currently using :

-- Authentication : 1) Token based
2) Kubernetes based

-- Reading and Writing to KeyValue secret engine

-- Reading and Writing to Transit Engine. Creating new encryption key, key rotation and version based key fetch.

The proposed Helidon based Vault client can provide interfaces to interact with different vault secret engines and to manage authentication.

thanks
Vipin

[rijureghunath1]

Few additional use-case, based on our experience on working with Hashicorp and OCI vault.

1. The implementation should work with different vault impl (Hashicorp, OCI etc.).

2. Support to design an application without real or minimal knowledge of Vault and its API's. For Hashcorp vault provides init / sidecar pattern for containers on Kubernetes based deployments.

3. Library support should be there to export transit key to the caller based on provided parameter's such as transit key path and name.

4. Multiple engine support. Key engines we uses with our applications are KV, PKI and Transit

5. Good support for muti-tenant SAAS applications. For e.g each tenant could be owning different KV data storage containing data specific to that tenant An easy way for CRUD is desirable by abstracting necessary stuffs within the library.

[tomas-langer]

Todos after the draft PR:

There is now an epic for follow up: #2966