HashiCorpVaultProvider

HashiCorp Vault secret provider (KV v2).

class scamander.secrets.vault.HashiCorpVaultProvider(vault_addr: str | None = None, vault_role: str | None = None, default_mount: str = 'secret')

Bases: SecretProvider

Retrieve secrets from a self-hosted HashiCorp Vault KV v2 store.

Designed for Kubernetes-based Spark workloads. Authentication is tried in this order:

  1. Kubernetes service-account JWT — when the pod has a bound service account its JWT is read from /var/run/secrets/kubernetes.io/serviceaccount/token and exchanged for a Vault token via the Kubernetes auth method.

  2. ``VAULT_TOKEN`` environment variable — for local development with vault server -dev or CI pipelines that inject a token directly.

Secrets must be stored in KV v2 with a single value field:

vault kv put secret/database/pg-password value=hunter2
Parameters:

  • vault_addr – Vault server address. Defaults to the VAULT_ADDR environment variable, falling back to "http://vault:8200".

  • vault_role – Vault role used for Kubernetes auth. Defaults to the VAULT_ROLE environment variable, falling back to "scamander".

  • default_mount – Default KV mount path used when vault is not passed to get_secret(). Defaults to "secret".

Example:

provider = HashiCorpVaultProvider()
password = provider.get_secret("database/pg-password")

# Override mount per-call:
token = provider.get_secret("api/token", vault="infrastructure")
get_secret(secret_name: str, vault: str | None = None) → str

Retrieve a secret from HashiCorp Vault KV v2.

Parameters:

  • secret_name – Path to the secret within the KV mount (e.g. "database/pg-password").

  • vault – KV mount path. Overrides default_mount set in the constructor.

Returns:

The string stored under the value key at the given path.

Raises:

  • ImportError – When hvac is not installed.

  • RuntimeError – When neither Kubernetes JWT nor VAULT_TOKEN is available.