# Python script to renew key from Vault every 30s

A small Python lib to renew key from Vault every 30s to always get the latest key.

from __future__ import print_function

import hvac
import time
import os

VAULT_TOKEN = os.environ['VAULT_TOKEN']

class Client:
def __init__(self, *keys):
self.keys = keys
self.data_dict = {}
self.client = hvac.Client(
url=VAULT_URL,
token=VAULT_TOKEN)

self.__renew()

for key in self.keys:
return self.data_dict

def __renew(self):
self.client.renew_token()

if __name__ == '__main__':
client = Client('secret/key')

• What kind of output does this generate? A steady stream of new keys, a onetime output? – holroy May 12 '17 at 20:05

I don't really see the need for threading here, as it seems like it only generates a one-time key. If this was some kind of long-time running process it would make a little more sense, but I still believe I would rather use a method which kept track of the last request, and if that request was made more than 30 seconds ago then read a new key from the hvac.Client.

The following code is totally untested:

import hvac
import time
import os
import datetime

VAULT_TOKEN = os.environ['VAULT_TOKEN']

class Client:
def __init__(self, *keys):
self.keys = keys
self.data_dict = {}
self.client = hvac.Client(
url=VAULT_URL,
token=VAULT_TOKEN)

self.client.renew_token()

for key in self.keys:

# If more than 30s since last read, renew keys
if (datetime.now() - self.last_read).total_seconds() > 30:

# Return the secret keys
return self.data_dict


Hopefully, not too many errors in there, but it should the gist of the idea, if I understood your underlying requirements of getting new keys every 30s or so correctly.

• Can you maybe explain a bit more why threading is not needed? – toy May 17 '17 at 22:02

You don't need a class here. Neither you need a Timer.

import hvac
import time
import os
import sys

VAULT_URL, VAULT_TOKEN = sys.argv[1:]