Qdrant database secrets engine

Qdrant is one of the supported plugins for the database secrets engine. It integrates with Qdrant's Granular Access API Keys to generate dynamic, short-lived JSON Web Tokens (JWT) signed with the master API key using HS256:

• Initialize (and VerifyConnection) call the configured server's /readyz endpoint, sending the configured api_key as the api-key header, to confirm the server is reachable and that the key is accepted.
• Dynamic credentials (bao read database/creds/...) generate a unique username, insert a validation point into the validation collection (openbao_users), and sign an HS256 JWT containing collection permissions from creation_statements, lease TTL (exp), and a value_exists claim.
• When a lease expires or is revoked via bao lease revoke, OpenBao removes the validation point from Qdrant, causing Qdrant to immediately reject any subsequent requests using that token.

See the database secrets engine docs for more information about setting up the database secrets engine.

Capabilities

Plugin Name	Root Credential Rotation	Dynamic Roles	Static Roles	Username Customization
qdrant-database-plugin	No	Yes	No	Yes

Setup

1. Enable the database secrets engine if it is not already enabled:

   $ bao secrets enable database
   Success! Enabled the database secrets engine at: database/

   By default, the secrets engine will enable at the name of the engine. To enable the secrets engine at a different path, use the -path argument.

2. Configure OpenBao with the proper plugin and connection information:

   $ bao write database/config/qdrant \
       plugin_name="qdrant-database-plugin" \
       url="https://qdrant.example.com:6333" \
       api_key="topsecret" \
       allowed_roles="app"
   Success! Data written to: database/config/qdrant

3. Configure a dynamic role with collection-specific permissions in creation_statements:

   $ bao write database/roles/app \
       db_name="qdrant" \
       creation_statements='{"access": [{"collection": "test_collection", "access": "rw"}]}' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/app

Usage

After the secrets engine is configured and a user/machine has an OpenBao token with the proper permission, it can generate dynamic credentials.

1. Generate dynamic credentials by reading from the /creds endpoint with the name of the role:

   $ bao read database/creds/app
   Key                Value
   ---                -----
   lease_id           database/creds/app/0c65456d-70ad-4af6-b5b8-0afe017ae517
   lease_duration     1h
   lease_renewable    true
   password           eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
   username           v-kubernet-k8s.53e2-gsw5HQPaxEPROnaZAWuZ-1788435207

   The password field contains the signed JWT token, which can be presented to Qdrant via the api-key header or Authorization: Bearer <token>.

2. To revoke credentials before lease expiry:

   $ bao lease revoke database/creds/app/0c65456d-70ad-4af6-b5b8-0afe017ae517
   Success! Revoked lease: database/creds/app/0c65456d-70ad-4af6-b5b8-0afe017ae517