Weaviate database secrets engine

Weaviate is one of the supported plugins for the database secrets engine. For Weaviate v1.30+ with AUTHENTICATION_DB_USERS_ENABLED=true and AUTHORIZATION_ENABLE_RBAC=true, this plugin supports dynamic credentials via Weaviate's User Management and RBAC REST APIs:

• Initialize (and VerifyConnection) call the configured server's /v1/.well-known/ready endpoint, sending the configured api_key as a Bearer token, to confirm the server is reachable and that the key is accepted.
• Dynamic credentials (bao read database/creds/...) generate a unique username, create the user via POST /v1/users/db/{user_id}, assign roles configured in creation_statements via POST /v1/authz/users/{id}/assign, and return Weaviate's generated API key in password.
• Deletion (DeleteUser) deletes the user from Weaviate via DELETE /v1/users/db/{user_id} when the lease expires or is revoked.

See the database secrets engine docs for more information about setting up the database secrets engine.

Capabilities

Plugin Name	Root Credential Rotation	Dynamic Roles	Static Roles	Username Customization
weaviate-database-plugin	No	Yes	No	Yes

Setup

1. Enable the database secrets engine if it is not already enabled:

   $ bao secrets enable database
   Success! Enabled the database secrets engine at: database/

   By default, the secrets engine will enable at the name of the engine. To enable the secrets engine at a different path, use the -path argument.

2. Configure OpenBao with the proper plugin and connection information:

   $ bao write database/config/weaviate \
       plugin_name="weaviate-database-plugin" \
       url="https://weaviate.example.com:8080" \
       api_key="admin-key" \
       allowed_roles="app"
   Success! Data written to: database/config/weaviate

3. Configure a dynamic role with the roles assigned in creation_statements:

   $ bao write database/roles/app \
       db_name="weaviate" \
       creation_statements='{"roles": ["viewer"]}' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/app

   Custom roles can also be declared inline under custom_roles:

   $ bao write database/roles/app \
       db_name="weaviate" \
       creation_statements='{"roles": ["viewer"], "custom_roles": [{"name": "customrole", "permissions": [{"action": "read_data", "collections": {"collection": "Products"}}]}]}' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/app

Usage

After the secrets engine is configured and a user/machine has an OpenBao token with the proper permission, it can generate dynamic credentials.

1. Generate dynamic credentials by reading from the /creds endpoint with the name of the role:

   $ bao read database/creds/app
   Key                Value
   ---                -----
   lease_id           database/creds/app/0c65456d-70ad-4af6-b5b8-0afe017ae517
   lease_duration     1h
   lease_renewable    true
   password           weaviate-user-api-key-...
   username           v-kubernet-k8s.53e2-gsw5HQPaxEPROnaZAWuZ-1788435207

   The password field contains Weaviate's generated API key, which can be presented to Weaviate in the Authorization: Bearer <token> header.

2. To revoke credentials before lease expiry:

   $ bao lease revoke database/creds/app/0c65456d-70ad-4af6-b5b8-0afe017ae517
   Success! Revoked lease: database/creds/app/0c65456d-70ad-4af6-b5b8-0afe017ae517