VaultTransitOptions Class
Points the custodian at a HashiCorp Vault / OpenBao Transit secrets engine: where it is and how to authenticate to it, and nothing about which keys to use. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration.
public sealed class VaultTransitOptionsInheritance System.Object → VaultTransitOptions
Properties
VaultTransitOptions.Address Property
Base URL of the Vault / OpenBao server, e.g. http://127.0.0.1:8200.
public string Address { get; set; }Property Value
VaultTransitOptions.Authentication Property
Makes the package log in to Vault itself - with the pod's Kubernetes service account or an AppRole - and keep the resulting token renewed for the process lifetime. Absent by default: a host that hands over Token keeps owning it.
public Abblix.Jwt.Vault.VaultAuthenticationOptions? Authentication { get; set; }Property Value
VaultTransitOptions.PooledConnectionLifetime Property
How long a pooled HTTP connection is reused before it is recycled. The Transit client is held long-lived by the singleton key store, so recycling connections lets it pick up DNS changes without handler rotation (default 2 minutes, matching the default IHttpClientFactory handler lifetime).
public System.TimeSpan PooledConnectionLifetime { get; set; }Property Value
VaultTransitOptions.Token Property
Auth token presented as the X-Vault-Token header, for a host that already has one and owns its
lifetime. Source it from the environment or a secret store, never hardcode it. A production host
normally configures Authentication instead, which REPLACES this value outright: a stale
token left in configuration is then never presented, not even before the first login completes.
public string? Token { get; set; }Property Value
VaultTransitOptions.TransitMount Property
Mount path of the Transit engine (the default mount is transit).
public string TransitMount { get; set; }