0
# Apache Airflow Providers HashiCorp
1

2
Apache Airflow provider package for HashiCorp Vault integration, enabling secure secret management and authentication within Airflow workflows. This provider allows Airflow to securely retrieve secrets, connections, and configurations from HashiCorp Vault using various authentication methods.
3

4
## Package Information
5

6
- **Package Name**: apache-airflow-providers-hashicorp
7
- **Package Type**: pypi
8
- **Language**: Python
9
- **Installation**: `pip install apache-airflow-providers-hashicorp`
10

11
## Core Imports
12

13
```python
14
from airflow.providers.hashicorp.hooks.vault import VaultHook
15
from airflow.providers.hashicorp.secrets.vault import VaultBackend
16
```
17

18
## Basic Usage
19

20
```python
21
from airflow.providers.hashicorp.hooks.vault import VaultHook
22

23
# Initialize Vault hook with connection ID
24
vault_hook = VaultHook(vault_conn_id='vault_default')
25

26
# Retrieve a secret from Vault
27
secret = vault_hook.get_secret('path/to/secret')
28
print(secret)  # {'key': 'value', 'password': 'secret123'}
29

30
# Create or update a secret
31
new_secret = {'username': 'user', 'password': 'newpass'}
32
response = vault_hook.create_or_update_secret('path/to/new/secret', new_secret)
33

34
# Get secret metadata (KV version 2 only)
35
metadata = vault_hook.get_secret_metadata('path/to/secret')
36
print(metadata['versions'])  # Version information
37
```
38

39
## Architecture
40

41
The provider package follows Airflow's provider architecture pattern with three main components:
42

43
- **VaultHook**: Primary interface for interacting with HashiCorp Vault's Key-Value secret engine
44
- **VaultBackend**: Secrets backend that automatically retrieves Airflow connections, variables, and configurations from Vault
45
- **Connection Types**: Defines 'vault' connection type for Airflow UI integration
46

47
This architecture enables both programmatic access to Vault secrets within DAGs and automatic secret retrieval for Airflow's core functionality.
48

49
## Capabilities
50

51
### Vault Hook Operations
52

53
Direct interaction with HashiCorp Vault for secret management operations, including reading, writing, and managing secrets with support for both KV version 1 and 2 engines.
54

55
```python { .api }
56
class VaultHook:
57
    def __init__(self, vault_conn_id: str = None, auth_type: str = "token", **kwargs): ...
58
    def get_secret(self, secret_path: str, secret_version: int | None = None) -> dict | None: ...
59
    def create_or_update_secret(self, secret_path: str, secret: dict, method: str | None = None, cas: int | None = None): ...
60
    def get_secret_metadata(self, secret_path: str) -> dict | None: ...
61
```
62

63
[Vault Hook](./vault-hook.md)
64

65
### Secrets Backend Integration
66

67
Automatic retrieval of Airflow connections, variables, and configurations from HashiCorp Vault, enabling seamless integration with Airflow's secrets management system.
68

69
```python { .api }
70
class VaultBackend:
71
    def __init__(self, connections_path: str = "connections", variables_path: str = "variables", **kwargs): ...
72
    def get_connection(self, conn_id: str): ...
73
    def get_variable(self, key: str) -> str | None: ...
74
    def get_config(self, key: str) -> str | None: ...
75
```
76

77
[Secrets Backend](./secrets-backend.md)
78

79
### Authentication Methods
80

81
Support for multiple HashiCorp Vault authentication methods including token, AppRole, Kubernetes, AWS IAM, Azure AD, GCP, LDAP, and more.
82

83
```python { .api }
84
# Supported authentication types
85
SUPPORTED_AUTH_TYPES = [
86
    "approle", "github", "gcp", "kubernetes", 
87
    "ldap", "token", "userpass", "aws_iam", 
88
    "azure", "radius"
89
]
90
```
91

92
[Authentication](./authentication.md)