How kelleyblackmore/automatic-secret-rotation works
Automatic Secret Rotation is a Rust CLI and library for managing secrets across storage backends and updating configured systems when credentials rotate. The main workflow starts with a CLI command, loads configuration, selects a backend, and invokes rotation or scanning; rotation can also update and verify configured targets. The README documents additional secret-management commands, optional backends and targets, environment synchronization, audit logging, and webhook notifications. The CLI and rotation excerpts show the central orchestration; unsampled integrations are included as documented capabilities, with their internal wiring left unspecified.
Main entry points: cli.rs CLI commands · target.rs Target interface · rotation.rs Rotation logic · secret_backend.rs Backend interface
Components 25
CLI and configuration
- CLI entry point
src/main.rs - CLI commands
src/cli.rs - Configuration
src/config.rs
Rotation workflow
- Rotation logic
src/rotation.rs
Secret backends
- Backend interface
src/backends/secret_backend.rs - Vault backend
src/backends/vault.rs - AWS backend
src/backends/aws_secrets.rs - File backend
src/backends/file.rs - Azure backend
src/backends/azure_keyvault.rs - GCP backend
src/backends/gcp_secret_manager.rs - Kubernetes backend
src/backends/ocp.rs
Update targets
- Target interface
src/targets/target.rs - PostgreSQL target
src/targets/postgres.rs - MySQL target
src/targets/mysql.rs - API target
src/targets/api.rs - GitHub target
src/targets/github.rs - GitLab target
src/targets/gitlab.rs
Operations and utilities
- Audit log
src/audit.rs - Notifications
src/notification.rs - Environment sync
src/env_updater.rs - HTTP utilities
src/util/http.rs - Base64 utility
src/util/base64.rs - Path utility
src/util/path.rs - TLS utility
src/util/tls.rs
Other components
- Operator
Connections 32
- Operator → CLI entry point: runs
README.md - CLI entry point → CLI commands: dispatches
src/main.rs - CLI commands → Configuration: loads
src/cli.rs - CLI commands → Rotation logic: invokes
src/cli.rs - CLI commands → Backend interface: selects backend
src/cli.rs - Rotation logic → Backend interface: reads and writes
src/rotation.rs - Rotation logic → Target interface: updates and verifies
src/rotation.rs - CLI commands → Audit log: records events
src/cli.rs - CLI commands → Notifications: notifies
src/cli.rs - CLI commands → Environment sync: syncs values
src/cli.rs - CLI commands → Vault backend: constructs backend
src/cli.rs - CLI commands → AWS backend: constructs backend
src/cli.rs - CLI commands → File backend: constructs backend
src/cli.rs - CLI commands → Azure backend: constructs backend
src/cli.rs - Backend interface → Vault backend: implemented by
src/backends/vault.rs - Backend interface → File backend: implemented by
src/backends/file.rs - Backend interface → Azure backend: implemented by
src/backends/azure_keyvault.rs - Rotation logic → GCP backend: uses selected backend
- Rotation logic → Kubernetes backend: uses selected backend
- Target interface → PostgreSQL target: implemented by
src/targets/target.rs - Target interface → API target: implemented by
src/targets/target.rs - Target interface → GitHub target: implemented by
src/targets/target.rs - Target interface → GitLab target: implemented by
src/targets/target.rs - Target interface → MySQL target: implemented by
src/targets/target.rs - Notifications → HTTP utilities: uses
src/notification.rs - Azure backend → HTTP utilities: uses
src/backends/azure_keyvault.rs - GitHub target → HTTP utilities: uses
src/targets/github.rs - GitHub target → Base64 utility: uses
src/targets/github.rs - Azure backend → Path utility: uses
src/backends/azure_keyvault.rs - Kubernetes backend → Path utility: uses
src/backends/ocp.rs - PostgreSQL target → TLS utility: uses
src/targets/postgres.rs - MySQL target → TLS utility: uses
src/targets/mysql.rs