class

CRE::Rotators::VaultDynamicRotator

Inherits CRE::Rotators::Rotator < Reference < Object

VaultDynamicRotator manages dynamic-secrets-engine credentials in HashiCorp Vault. Vault itself is the secret factory: we ask it for fresh creds and revoke old leases on commit.

Required Credential.tags: "role_path" - e.g. "database/creds/my-postgres-role" Optional "current_lease_id" - the lease to revoke on commit; if absent the rotator only revokes the NEW lease on rollback (apply step).

Constructors

new(client : Vault::Client)
Source

Instance methods

apply(c : Domain::Credential, s : Domain::NewSecret) : Nil
Source
can_rotate?(c : Domain::Credential) : Bool
Source
commit(c : Domain::Credential, s : Domain::NewSecret) : Nil
Source
generate(c : Domain::Credential) : Domain::NewSecret
Source
kind
Source
rollback_apply(c : Domain::Credential, s : Domain::NewSecret) : Nil

Default no-op; rotators override when apply() creates reversible side effects.

Source
verify(c : Domain::Credential, s : Domain::NewSecret) : Bool
Source