llm4s-docs
0.5.1+3497c51d4a3-SNAPSHOT
API
Generated with
llm4s-docs/org.llm4s/org.llm4s.llmconnect/org.llm4s.llmconnect.auth/org.llm4s.llmconnect.auth.vault

org.llm4s.llmconnect.auth.vault

package org.llm4s.llmconnect.auth.vault

Members list

Type members

Classlikes

@Experimental
final class VaultApiKeyProvider extends ApiKeyProvider, AutoCloseable

An ApiKeyProvider that reads the API key from HashiCorp Vault's key/value secrets engine over Vault's HTTP API (#2479), for a deployment that cannot run Vault Agent or a CSI driver to write the key to a file (apiKeyFile).

An ApiKeyProvider that reads the API key from HashiCorp Vault's key/value secrets engine over Vault's HTTP API (#2479), for a deployment that cannot run Vault Agent or a CSI driver to write the key to a file (apiKeyFile).

The key is read on the first current(), then reused for VaultSettings.refreshInterval, then read again, so a key rotated in Vault is sent from the first request after the interval. Concurrent callers share one read. A read that fails is a Left and is tried again on the next call; the last key is not served after its interval, since a rotated-out key may already be revoked.

for
 keys   <- VaultApiKeyProvider(VaultSettings(vaultAddress, Secret(vaultToken), "llm4s/openai", "apiKey"))
 config <- Llm4sConfig.provider("openai-main").map(_.withApiKeyProvider(keys))
 client <- LLMConnect.getClient(config)
yield client

Errors never hold the key or the Vault token: an AuthenticationError when Vault refuses the token (401, 403), a NotFoundError when there is no secret at the path, a ConfigurationError when the secret has no usable string field, a ServiceError for any other status, and the HTTP client's own error when Vault cannot be reached.

It depends on no Vault SDK: one GET with llm4s's own HTTP client. Close it to close the HTTP client it created; one passed to VaultApiKeyProvider(settings, httpClient) stays the caller's to close.

Attributes

Companion
object
Source
VaultApiKeyProvider.scala
Supertypes
class Object
trait Matchable
class Any
@Experimental
object VaultApiKeyProvider

Attributes

Companion
class
Source
VaultApiKeyProvider.scala
Supertypes
class Object
trait Matchable
class Any
Self type
@Experimental
final case class VaultSettings

Where VaultApiKeyProvider reads an API key in HashiCorp Vault (#2479): the field field of the secret at path in the key/value secrets engine mounted at mount.

Where VaultApiKeyProvider reads an API key in HashiCorp Vault (#2479): the field field of the secret at path in the key/value secrets engine mounted at mount.

// the field apiKey of secret/data/llm4s/openai (KV version 2, mounted at secret/)
val settings = VaultSettings("https://vault.internal:8200", Secret(vaultToken), "llm4s/openai", "apiKey")
 .withRefreshInterval(1.minute)

Value parameters

address

Vault's base URL, http(s)://host:port, without /v1

field

the key of the secret's data that holds the API key

kvVersion

the KV engine's version: V2 (versioned, the default) or V1

mount

the path the KV secrets engine is mounted at; secret by default, as in vault server -dev

namespace

the Vault Enterprise / HCP Vault namespace, sent as X-Vault-Namespace

path

the secret's path inside the mount, such as llm4s/openai

refreshInterval

how long a key read from Vault is used before it is read again

requestTimeout

how long one read from Vault may take

token

the Vault token sent as X-Vault-Token; never printed by toString nor put in an error

Attributes

Companion
object
Source
VaultSettings.scala
Supertypes
trait Serializable
trait Product
trait Equals
class Object
trait Matchable
class Any
Show all
object VaultSettings

Attributes

Companion
class
Source
VaultSettings.scala
Supertypes
trait Product
trait Mirror
class Object
trait Matchable
class Any
Self type
Generated with