openshell-driver-vault

openshell-driver-vault --bind-socket PATH --address URL [options]

openshell-driver-vault is the Vault credential driver for NVIDIA OpenShell. It serves the CredentialDriver gRPC API on a Unix socket. openshell-gateway uses that API to store and resolve provider credentials. The process removes the socket when it exits.--bind-socket is required. The parent directory is created if needed. An existing socket is removed and replaced. Any other file at that path is an error. The new socket is mode 0600. The listener does not check the peer pid; access is the file mode.--address is required. It must be an absolute http or https URL with a host, no userinfo, and no query or fragment. http is accepted only for a loopback host (an IP or the name localhost). A CA bundle requires https. Requests go directly to that host: HTTP proxies are disabled, and redirects are refused.The default auth method is kubernetes. That method requires --role. The Kubernetes auth mount defaults to kubernetes, and the service-account token path defaults to the standard in-cluster token file. token_file requires --token-path and rejects the Kubernetes auth flags.The KV mount defaults to secret. The KV version defaults to 2 (version 1 is the other accepted value). The HTTP timeout defaults to 10 seconds. Listing credentials is not implemented.The gateway table that carries the same fields is [openshell.credential_drivers.vault]. Unknown keys are rejected. This binary does not read that file itself; the flags are the standalone configuration.

--bind-socket PATH

Required. Unix socket for the CredentialDriver service.

Required. Vault API address.

PEM CA bundle. Requires an https address. An empty bundle is an error.

KV mount path. Default secret.

KV engine version. Default 2.

kubernetes (the default) or token_file.

Vault role. Required for kubernetes. Rejected for token_file.

Auth mount for the Kubernetes login. Default kubernetes. Only valid with kubernetes.

JWT presented to the Kubernetes auth method. Default is the in-cluster service-account token file. Only valid with kubernetes.

File containing a Vault token. Required for token_file. Rejected for kubernetes.

HTTP client timeout. Default 10. Must be a positive integer.

Log level. Default info. Used when the process environment does not already set a tracing filter.

A gateway table with the same fields:

$ [openshell.credential_drivers.vault]
address = "https://vault.example:8200"
auth_method = "token_file"
token_path = "/etc/openshell/vault-token"
mount = "secret"
kv_version = "2"
timeout_secs = 10

$ --bind-socket                    OPENSHELL_CREDENTIAL_DRIVER_SOCKET
--address                        OPENSHELL_VAULT_ADDRESS
--ca-bundle                      OPENSHELL_VAULT_CA_BUNDLE
--mount                          OPENSHELL_VAULT_MOUNT
--kv-version                     OPENSHELL_VAULT_KV_VERSION
--auth-method                    OPENSHELL_VAULT_AUTH_METHOD
--role                           OPENSHELL_VAULT_ROLE
--kubernetes-auth-mount          OPENSHELL_VAULT_KUBERNETES_AUTH_MOUNT
--service-account-token-path     OPENSHELL_VAULT_SERVICE_ACCOUNT_TOKEN_PATH
--token-path                     OPENSHELL_VAULT_TOKEN_PATH
--timeout-secs                   OPENSHELL_VAULT_TIMEOUT_SECS
--log-level                      OPENSHELL_LOG_LEVEL

The default auth method is kubernetes, so a command line that sets only --address fails until --role is set or the auth method is switched to token_file.Tokens and secret values are not written to logs by this process. The HTTP client never follows a redirect and never uses a proxy.A KV version other than 1 or 2, or an auth method other than the two names above, is a startup error.The socket is unlinked after the server stops. A crash can leave a stale socket; the next start removes it only when it is still a socket.

openshell-driver-vault ships in NVIDIA OpenShell (Apache License 2.0). OpenShell was first published in March 2026. The 0.1.x line is the stable release cadence.

openshell(1), openshell-gateway(1), openshell-driver-kubernetes-secrets(1), vault(1)

Source code · Homepage