feat(config): add vault provider

Signed-off-by: Frank Yang <[email protected]>

crates/config/Cargo.toml

@@ -13,6 +13,8 @@ spin-app = { path = "../app" }
 spin-core = { path = "../core" }
 thiserror = "1"
 tokio = { version = "1", features = ["rt-multi-thread"] }
+vaultrs = "0.6.2"
+serde = "1.0.145"
 
 [dependencies.wit-bindgen-wasmtime]
 git = "https://github.com/bytecodealliance/wit-bindgen"

crates/config/src/provider.rs

@@ -6,6 +6,7 @@ use crate::Key;
 
 /// Environment variable based provider.
 pub mod env;
+pub mod vault;
 
 /// A config provider.
 #[async_trait]

crates/config/src/provider/vault.rs

@@ -0,0 +1,50 @@
+use anyhow::{anyhow, Result};
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use vaultrs::{
+    client::{VaultClient, VaultClientSettingsBuilder},
+    kv2,
+};
+
+use crate::{Key, Provider};
+
+/// A config Provider that uses HashiCorp Vault.
+#[derive(Debug)]
+pub struct VaultProvider {
+    url: String,
+    token: String,
+}
+
+impl VaultProvider {
+    pub fn new(url: impl AsRef<String>, token: impl AsRef<String>) -> Result<Self> {
+        Ok(Self {
+            url: url.as_ref().to_string(),
+            token: token.as_ref().to_string(),
+        })
+    }
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+struct Secret {
+    value: String,
+}
+
+#[async_trait]
+impl Provider for VaultProvider {
+    async fn get(&self, key: &Key) -> Result<Option<String>> {
+        let client = VaultClient::new(
+            VaultClientSettingsBuilder::default()
+                .address(&self.url)
+                .token(&self.token)
+                .build()?,
+        )?;
+        let keys = key.0.split("/").collect::<Vec<_>>();
+        if keys.len() == 1 {
+            return Err(anyhow!("vault key must contain the mount path"));
+        }
+        let mount = keys[0];
+        let path = keys[1..].join("/");
+        let secret: Secret = kv2::read(&client, mount, &path).await?;
+        Ok(Some(secret.value))
+    }
+}