Weave Code
Vault Bundle Laravel Package
itk-dev/vault-bundle
Symfony bundle for integrating HashiCorp Vault with your PHP application. Configure Vault connections and authentication, read and manage secrets, and inject Vault-backed values into Symfony services and configuration. Helps keep sensitive credentials out of code and environment files.
Symfony bundle for HashiCorp Vault
Frequently asked questions about Vault Bundle
- Does itk-dev/vault-bundle work with Laravel?
- No. itk-dev/vault-bundle is a Symfony bundle built around Symfony's Bundle, DI extension, and compiler pass; it does not ship a Laravel service provider, config repository, or facade. Laravel teams can reuse the underlying Vault client, but they must own the integration layer.
- How do I install itk-dev/vault-bundle in a Laravel app?
- You can run composer require itk-dev/vault-bundle, but installing it in Laravel does not activate it. Laravel will not register the Symfony bundle or resolve its services, so you would need to wrap the Vault client in your own service provider. Budget roughly 1–3 weeks plus security review for a production-grade adapter.
- Can I inject HashiCorp Vault secrets into Laravel config with this package?
- Not out of the box. The bundle injects Vault-backed values into Symfony services and configuration through Symfony's DI container, not Laravel's config repository. Laravel's config:cache semantics are not handled, so a custom config repository or bootstrapping layer is required.
- What Laravel versions and PHP versions are supported?
- The package targets Symfony, and the 1.0.0 release nominally adds Symfony 8 support alongside earlier Symfony versions. There is no Laravel version support because there is no Laravel integration. Check the Composer constraints and CI matrix for exact PHP and Symfony combinations before adopting.
- How does it handle Vault authentication methods like AppRole or Kubernetes?
- The bundle exposes configurable Vault client and connection settings, and the underlying Vault capability includes AppRole, Kubernetes, and token auth. The evaluation flags token and lease renewal as something to verify: it may be delegated to the wrapped client library rather than implemented by the bundle. Confirm renewal, TLS/CA validation, and secret caching behavior before production.
- Are secrets resolved at container compile time or runtime?
- The evaluation describes secret resolution at container build or compile time, which keeps Vault on the startup critical path. The bundle is intended to resolve secrets into the DI container at boot, so values are likely held in memory as container parameters or service arguments. Whether runtime retrieval is also supported, and what is cached where, should be verified in the code.
- What happens if Vault is sealed or unreachable during boot?
- Fail-closed is the expected behavior: if Vault is sealed or unreachable when the container is built, boot should fail rather than start with missing secrets. The evaluation notes that retry or deferred resolution is not documented, so plan for hard failure at deploy and cold start. That is safer for secrets but increases blast radius for every deploy.
- Is itk-dev/vault-bundle production-ready and actively maintained?
- Treat it as unproven for production. The repository has very low adoption (around 2 stars and 0 dependents), a second contributor has landed only the Symfony 8 work, and the 1.0.0 tag looks ceremonial rather than an API-stabilization milestone. The changelog is internally inconsistent, so do not read 1.0.0 as a maturity signal.
- Does it support Vault KV v2 and Enterprise namespaces?
- The underlying Vault capability includes KV v1 and v2 retrieval, but the bundle's KV v2 path translation and Vault Enterprise namespace support are not confirmed in the overview. The evaluation explicitly lists these as open questions. Test your exact mount paths and namespace requirements before relying on it.
- What are alternatives for using HashiCorp Vault with Laravel?
- For Laravel, the realistic options are to wrap a Vault PHP client in a Laravel service provider and config repository, hydrate environment variables at deploy time, or run a sidecar. All three mean you own the integration layer. itk-dev/vault-bundle is useful as a Symfony reference implementation, not as an installable Laravel package.
Weaver
How can I help you explore Laravel packages today?