# kelleyblackmore/automatic-secret-rotation architecture

> Architecture diagram of the GitHub repository kelleyblackmore/automatic-secret-rotation, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kelleyblackmore/automatic-secret-rotation
- Repository: https://github.com/kelleyblackmore/automatic-secret-rotation

## Overview

Automatic Secret Rotation is a Rust CLI and library for managing secrets across storage backends and updating configured systems when credentials rotate. The main workflow starts with a CLI command, loads configuration, selects a backend, and invokes rotation or scanning; rotation can also update and verify configured targets. The README documents additional secret-management commands, optional backends and targets, environment synchronization, audit logging, and webhook notifications. The CLI and rotation excerpts show the central orchestration; unsampled integrations are included as documented capabilities, with their internal wiring left unspecified.

Main entry points: [`src/cli.rs`](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/cli.rs) (CLI commands), [`src/targets/target.rs`](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/target.rs) (Target interface), [`src/rotation.rs`](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/rotation.rs) (Rotation logic), [`src/backends/secret_backend.rs`](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/secret_backend.rs) (Backend interface)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI and configuration"]
  node_application["CLI entry point<br/>[main.rs]"]
  node_commands["CLI commands<br/>[cli.rs]"]
  node_configuration["Configuration<br/>[config.rs]"]
end

subgraph group_rotation["Rotation workflow"]
  node_rotation_logic["Rotation logic<br/>[rotation.rs]"]
end

subgraph group_storage["Secret backends"]
  node_backend_trait["Backend interface<br/>[secret_backend.rs]"]
  node_vault["Vault backend<br/>[vault.rs]"]
  node_aws["AWS backend<br/>[aws_secrets.rs]"]
  node_file_backend[("File backend<br/>[file.rs]")]
  node_azure["Azure backend<br/>[azure_keyvault.rs]"]
  node_gcp["GCP backend"]
  node_ocp["Kubernetes backend<br/>[ocp.rs]"]
end

subgraph group_targets["Update targets"]
  node_target_interface["Target interface<br/>[target.rs]"]
  node_postgres["PostgreSQL target<br/>[postgres.rs]"]
  node_mysql["MySQL target<br/>[mysql.rs]"]
  node_api_target["API target<br/>[api.rs]"]
  node_github["GitHub target<br/>[github.rs]"]
  node_gitlab["GitLab target<br/>[gitlab.rs]"]
end

subgraph group_operations["Operations and utilities"]
  node_audit["Audit log<br/>[audit.rs]"]
  node_notifications["Notifications<br/>[notification.rs]"]
  node_env_sync["Environment sync<br/>[env_updater.rs]"]
  node_http_util["HTTP utilities<br/>[http.rs]"]
  node_base64_util["Base64 utility<br/>[base64.rs]"]
  node_path_util["Path utility<br/>[path.rs]"]
  node_tls_util["TLS utility<br/>[tls.rs]"]
end

node_operator(("Operator"))

node_operator -->|"runs"| node_application
node_application -->|"dispatches"| node_commands
node_commands -->|"loads"| node_configuration
node_commands -->|"invokes"| node_rotation_logic
node_commands -->|"selects backend"| node_backend_trait
node_rotation_logic -->|"reads and writes"| node_backend_trait
node_rotation_logic -->|"updates and verifies"| node_target_interface
node_commands -->|"records events"| node_audit
node_commands -->|"notifies"| node_notifications
node_commands -->|"syncs values"| node_env_sync
node_commands -->|"constructs backend"| node_vault
node_commands -->|"constructs backend"| node_aws
node_commands -->|"constructs backend"| node_file_backend
node_commands -->|"constructs backend"| node_azure
node_backend_trait -->|"implemented by"| node_vault
node_backend_trait -->|"implemented by"| node_file_backend
node_backend_trait -->|"implemented by"| node_azure
node_rotation_logic -.->|"uses selected backend"| node_gcp
node_rotation_logic -.->|"uses selected backend"| node_ocp
node_target_interface -->|"implemented by"| node_postgres
node_target_interface -->|"implemented by"| node_api_target
node_target_interface -->|"implemented by"| node_github
node_target_interface -->|"implemented by"| node_gitlab
node_target_interface -->|"implemented by"| node_mysql
node_notifications -->|"uses"| node_http_util
node_azure -->|"uses"| node_http_util
node_github -->|"uses"| node_http_util
node_github -->|"uses"| node_base64_util
node_azure -->|"uses"| node_path_util
node_ocp -->|"uses"| node_path_util
node_postgres -->|"uses"| node_tls_util
node_mysql -->|"uses"| node_tls_util

click node_application "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/main.rs"
click node_commands "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/cli.rs"
click node_configuration "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/config.rs"
click node_rotation_logic "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/rotation.rs"
click node_backend_trait "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/secret_backend.rs"
click node_vault "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/vault.rs"
click node_aws "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/aws_secrets.rs"
click node_file_backend "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/file.rs"
click node_azure "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/azure_keyvault.rs"
click node_gcp "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/gcp_secret_manager.rs"
click node_ocp "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/ocp.rs"
click node_target_interface "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/target.rs"
click node_postgres "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/postgres.rs"
click node_mysql "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/mysql.rs"
click node_api_target "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/api.rs"
click node_github "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/github.rs"
click node_gitlab "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/gitlab.rs"
click node_audit "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/audit.rs"
click node_notifications "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/notification.rs"
click node_env_sync "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/env_updater.rs"
click node_http_util "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/http.rs"
click node_base64_util "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/base64.rs"
click node_path_util "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/path.rs"
click node_tls_util "https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/tls.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_application,node_commands,node_configuration toneBlue
class node_rotation_logic toneAmber
class node_backend_trait,node_vault,node_aws,node_file_backend,node_azure,node_gcp,node_ocp toneMint
class node_target_interface,node_postgres,node_mysql,node_api_target,node_github,node_gitlab toneRose
class node_audit,node_notifications,node_env_sync,node_http_util,node_base64_util,node_path_util,node_tls_util,node_operator toneIndigo
```

## Components

### CLI and configuration

- [CLI entry point](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/main.rs): `src/main.rs`
- [CLI commands](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/cli.rs): `src/cli.rs`
- [Configuration](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/config.rs): `src/config.rs`

### Rotation workflow

- [Rotation logic](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/rotation.rs): `src/rotation.rs`

### Secret backends

- [Backend interface](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/secret_backend.rs): `src/backends/secret_backend.rs`
- [Vault backend](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/vault.rs): `src/backends/vault.rs`
- [AWS backend](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/aws_secrets.rs): `src/backends/aws_secrets.rs`
- [File backend](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/file.rs): `src/backends/file.rs`
- [Azure backend](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/azure_keyvault.rs): `src/backends/azure_keyvault.rs`
- [GCP backend](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/gcp_secret_manager.rs): `src/backends/gcp_secret_manager.rs`
- [Kubernetes backend](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/backends/ocp.rs): `src/backends/ocp.rs`

### Update targets

- [Target interface](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/target.rs): `src/targets/target.rs`
- [PostgreSQL target](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/postgres.rs): `src/targets/postgres.rs`
- [MySQL target](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/mysql.rs): `src/targets/mysql.rs`
- [API target](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/api.rs): `src/targets/api.rs`
- [GitHub target](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/github.rs): `src/targets/github.rs`
- [GitLab target](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/targets/gitlab.rs): `src/targets/gitlab.rs`

### Operations and utilities

- [Audit log](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/audit.rs): `src/audit.rs`
- [Notifications](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/notification.rs): `src/notification.rs`
- [Environment sync](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/env_updater.rs): `src/env_updater.rs`
- [HTTP utilities](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/http.rs): `src/util/http.rs`
- [Base64 utility](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/base64.rs): `src/util/base64.rs`
- [Path utility](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/path.rs): `src/util/path.rs`
- [TLS utility](https://github.com/kelleyblackmore/automatic-secret-rotation/blob/main/src/util/tls.rs): `src/util/tls.rs`

### Other components

- **Operator**

## Connections

- Operator → CLI entry point: runs (evidence: `README.md`)
- CLI entry point → CLI commands: dispatches (evidence: `src/main.rs`)
- CLI commands → Configuration: loads (evidence: `src/cli.rs`)
- CLI commands → Rotation logic: invokes (evidence: `src/cli.rs`)
- CLI commands → Backend interface: selects backend (evidence: `src/cli.rs`)
- Rotation logic → Backend interface: reads and writes (evidence: `src/rotation.rs`)
- Rotation logic → Target interface: updates and verifies (evidence: `src/rotation.rs`)
- CLI commands → Audit log: records events (evidence: `src/cli.rs`)
- CLI commands → Notifications: notifies (evidence: `src/cli.rs`)
- CLI commands → Environment sync: syncs values (evidence: `src/cli.rs`)
- CLI commands → Vault backend: constructs backend (evidence: `src/cli.rs`)
- CLI commands → AWS backend: constructs backend (evidence: `src/cli.rs`)
- CLI commands → File backend: constructs backend (evidence: `src/cli.rs`)
- CLI commands → Azure backend: constructs backend (evidence: `src/cli.rs`)
- Backend interface → Vault backend: implemented by (evidence: `src/backends/vault.rs`)
- Backend interface → File backend: implemented by (evidence: `src/backends/file.rs`)
- Backend interface → Azure backend: implemented by (evidence: `src/backends/azure_keyvault.rs`)
- Rotation logic → GCP backend: uses selected backend
- Rotation logic → Kubernetes backend: uses selected backend
- Target interface → PostgreSQL target: implemented by (evidence: `src/targets/target.rs`)
- Target interface → API target: implemented by (evidence: `src/targets/target.rs`)
- Target interface → GitHub target: implemented by (evidence: `src/targets/target.rs`)
- Target interface → GitLab target: implemented by (evidence: `src/targets/target.rs`)
- Target interface → MySQL target: implemented by (evidence: `src/targets/target.rs`)
- Notifications → HTTP utilities: uses (evidence: `src/notification.rs`)
- Azure backend → HTTP utilities: uses (evidence: `src/backends/azure_keyvault.rs`)
- GitHub target → HTTP utilities: uses (evidence: `src/targets/github.rs`)
- GitHub target → Base64 utility: uses (evidence: `src/targets/github.rs`)
- Azure backend → Path utility: uses (evidence: `src/backends/azure_keyvault.rs`)
- Kubernetes backend → Path utility: uses (evidence: `src/backends/ocp.rs`)
- PostgreSQL target → TLS utility: uses (evidence: `src/targets/postgres.rs`)
- MySQL target → TLS utility: uses (evidence: `src/targets/mysql.rs`)