Add option to override default mount_point for vault (dynaconf#349)

sfunkhouser · May 29, 2020 · a8038b8 · a8038b8
1 parent 4c75674
commit a8038b8
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 2 deletions.
diff --git a/docs/guides/configuration.md b/docs/guides/configuration.md
@@ -67,6 +67,7 @@ It can also be passed as parameters to extensions like `FlaskDynaconf` or set in
     VAULT_ENABLED | bool | Vault server is enabled. | false | VAULT_ENABLED_FOR_DYNACONF=true
     VAULT_HOST | str | Vault host. | localhost | VAULT_HOST_FOR_DYNACONF=”server”
     VAULT_PATH | str | Vault path to the configuration. | None | VAULT_PATH_FOR_DYNACONF=”secret_data”
+    VAULT_MOUNT_POINT | str | Vault mount point to the configuration. | secret | VAULT_MOUNT_POINT_FOR_DYNACONF=”kv”
     VAULT_PORT | str | Vault port. | 8200 | VAULT_PORT_FOR_DYNACONF=”2800”
     VAULT_PROXIES | dict | Vault proxies. | None | VAULT_PROXIES_FOR_DYNACONF={http=”http:/localhost:3128/”}
     VAULT_ROLE_ID | str | Vault Role ID. | None | VAULT_ROLE_ID_FOR_DYNACONF=”some-role-id”

diff --git a/dynaconf/default_settings.py b/dynaconf/default_settings.py
@@ -165,6 +165,9 @@ def reload(*args, **kwargs):
 VAULT_FOR_DYNACONF = get("VAULT_FOR_DYNACONF", default_vault)
 VAULT_ENABLED_FOR_DYNACONF = get("VAULT_ENABLED_FOR_DYNACONF", False)
 VAULT_PATH_FOR_DYNACONF = get("VAULT_PATH_FOR_DYNACONF", "dynaconf")
+VAULT_MOUNT_POINT_FOR_DYNACONF = get(
+    "VAULT_MOUNT_POINT_FOR_DYNACONF", "secret"
+)
 VAULT_ROLE_ID_FOR_DYNACONF = get("VAULT_ROLE_ID_FOR_DYNACONF", None)
 VAULT_SECRET_ID_FOR_DYNACONF = get("VAULT_SECRET_ID_FOR_DYNACONF", None)
 

diff --git a/dynaconf/loaders/vault_loader.py b/dynaconf/loaders/vault_loader.py
@@ -51,8 +51,11 @@ def load(obj, env=None, silent=None, key=None):
     env_list = build_env_list(obj, env)
     for env in env_list:
         path = "/".join([obj.VAULT_PATH_FOR_DYNACONF, env])
+        mount_point = obj.VAULT_MOUNT_POINT_FOR_DYNACONF
         try:
-            data = client.secrets.kv.read_secret_version(path)
+            data = client.secrets.kv.read_secret_version(
+                path, mount_point=mount_point
+            )
         except InvalidPath:
             # If the path doesn't exist, ignore it and set data to None
             data = None
@@ -103,7 +106,10 @@ def write(obj, data=None, **kwargs):
         raise AttributeError("Data must be provided")
     client = get_client(obj)
     path = "/".join([obj.VAULT_PATH_FOR_DYNACONF, obj.current_env.lower()])
-    client.secrets.kv.create_or_update_secret(path, secret=data)
+    mount_point = obj.VAULT_MOUNT_POINT_FOR_DYNACONF
+    client.secrets.kv.create_or_update_secret(
+        path, secret=data, mount_point=mount_point
+    )
     load(obj)