HashiCorp Vault

Source: https://runstack.engineer/docs/toolkits/vault

Secrets and policies: KV v2 read/write/list, mounts, seal/HA health, ACL policies, and token lifecycle via the Vault HTTP API.

Tools (18):

Tool	Description
`vaultKvRead`	Read the latest version of a secret from a KV secrets engine v2 mount (GET .../data/{path}).
`vaultKvWrite`	Write secret data to KV v2 (POST .../data/{path}). Supports check-and-set via cas option.
`vaultKvDelete`	Delete the latest version of a KV v2 secret (DELETE .../data/{path}).
`vaultKvList`	List secret keys under a path in KV v2 (LIST .../metadata/{path}).
`vaultKvReadMetadata`	Read KV v2 secret metadata (versions, custom metadata, delete flags).
`vaultKvDeleteMetadata`	Permanently delete all versions and metadata of a KV v2 secret.
`vaultKvDestroyVersions`	Permanently destroy specific KV v2 secret versions (POST .../destroy/{path}).
`vaultGetHealth`	Check Vault health and seal status (GET /sys/health). Uses address from credentials; does not require a valid token.
`vaultListMounts`	List enabled secrets engines and auth methods (GET /sys/mounts).
`vaultReadMount`	Read configuration of a specific mount (GET /sys/mounts/{path}).
`vaultGetSealStatus`	Get seal status (GET /sys/seal-status).
`vaultGetLeader`	Get HA leader address (GET /sys/leader).
`vaultListPolicies`	List ACL policies (GET /sys/policies/acl?list=true).
`vaultReadPolicy`	Read an ACL policy document by name (GET /sys/policies/acl/{name}).
`vaultLookupSelf`	Look up the current token (policies, TTL, metadata) via /auth/token/lookup-self.
`vaultRenewSelf`	Renew the current token lease (POST /auth/token/renew-self).
`vaultRevokeSelf`	Revoke the current token (POST /auth/token/revoke-self).
`vaultAppRoleLogin`	Exchange AppRole role_id and secret_id for a client token (POST /auth/approle/login). Prefer storing roleId/secretId in connect credentials so other tools login automatically.