TramAI - governed AI workflows for Java and Kotlin

tramai-spring-secrets-vault

Version: 0.6.0
Status: Preview
Role: Secret-backend module: resolves vault:<path>#<field> references.

Purpose

This module plugs a HashiCorp Vault resolver into TramAI's Spring secret chain. Any provider or secrets property can then point at a Vault path instead of holding a credential inline:

tramai:
  providers:
    anthropic:
      api-key-secret-ref: vault:providers/anthropic#api-key

The resolver contributes to the full chain only. Its own token is resolved through the bootstrap chain (user resolvers, env:, file:), which is what prevents Vault from having to resolve its own credential through itself.

What it provides

ComponentDetail
VaultSecretValueResolverSecretValueResolver implementation for the vault: scheme
VaultSecretValueResolverAutoConfigurationContributes the resolver to the full chain; inactive unless enabled
VaultSecretPropertiesBinds tramai.secrets.vault.*
KeyDefaultNotes
tramai.secrets.vault.enabledfalseResolver stays out of the chain unless true
tramai.secrets.vault.base-url—Required when enabled
tramai.secrets.vault.token—Direct token
tramai.secrets.vault.token-secret-ref—Token resolved through the bootstrap chain, e.g. env:VAULT_TOKEN
tramai.secrets.vault.namespace—Vault Enterprise namespace
tramai.secrets.vault.mount-pathsecretKV mount
tramai.secrets.vault.kv-version2KV v1 or v2
tramai.secrets.vault.default-fieldvalueField read when the reference names no field

Reference format: vault:<path>#<field>. Without #<field> the resolver looks for default-field, and falls back to the only entry when the secret holds exactly one value. References that carry no usable value resolve to nothing, which surfaces as a startup failure on the property that used the reference. Enabling Vault without base-url or without a resolvable token fails startup; secrets are never logged.

Dependencies

dependencies {
    implementation(platform("dev.tramai:tramai-bom:0.6.0"))
    implementation("dev.tramai:tramai-spring-boot-starter")
    implementation("dev.tramai:tramai-spring-secrets-vault")
}

tramai:
  secrets:
    vault:
      enabled: true
      base-url: https://vault.example.com
      token-secret-ref: env:VAULT_TOKEN
      mount-path: secret
      kv-version: 2

When to use this module

  • Provider credentials are managed centrally in Vault and must not appear in application configuration.
  • The Vault token is itself provisioned through an environment variable or a mounted file.

When NOT to use this module

  • Credentials live in files or the environment — file: (tramai-spring-secrets-file) or env: cover that without any additional dependency.
  • You use AWS Secrets Manager: use tramai-spring-secrets-aws.
  • You want the application to fetch secrets at request time rather than resolve them at startup.
Previous
Next