Skip to content

vaultclient

Resolve a Vault client once, and share it.

vaultclient hands out a *vaultapi.Client. Vault is the provider where the client is the connection prerequisite — there is no separate credential object to pass around — so that is what crosses the boundary.

src := vaultclient.Ambient()

client, err := src.VaultClient(ctx)

Four rungs, not three

Vault gets one more than the other provider modules, because a caller plausibly holds either half:

Rung You supply When
FromClient a built *vaultapi.Client you already have one
FromConfig a *vaultapi.Config you assembled the config; this builds the client
Ambient nothing VAULT_ADDR, VAULT_TOKEN and the rest
PerCall nothing the same, rebuilt every time and retained

It adopts Vault's own default

With nothing set, Ambient resolves https://127.0.0.1:8200 — which is what every Vault client on the machine does.

That is not this module inventing a default. Adopting a provider's documented default is a different act from making one up, which is why awsclient refuses to guess a region: AWS documents none.

⚠️ The token does not renew itself

This is the thing to know before you hold a Vault client for a long time.

vaultapi.NewClient reads VAULT_TOKEN once and holds it for the client's life. Nothing re-reads the environment; nothing renews the lease. A long-lived process holding a client from Ambient will fail every call once the token's TTL passes — with no path back, because the client cannot learn its credential lapsed.

This is unlike AWS, Azure and GCP, whose credential objects renew underneath you. What to do about it.

Start here

Where this comes from

org spec 0003 — built in the first pass on the strength of its second consumer (P-11), Vault being a fast-follow adapter for go/signing and go/encryption.