legion-crypt 1.5.38 → 1.5.42

data/lib/legion/crypt/cert_rotation.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
-require 'legion/crypt/vault_operation'
+require 'legion/crypt/vault/operation'
 
 module Legion
   module Crypt
@@ -53,8 +53,8 @@ module Legion
           @wake.broadcast
           @thread
         end
-        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::VaultOperation::SHUTDOWN_TIMEOUT
-        Legion::Crypt::VaultOperation.with_timeout(deadline: deadline) { thread.join } if thread && thread != Thread.current
+        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::Vault::Operation::SHUTDOWN_TIMEOUT
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) { thread.join } if thread && thread != Thread.current
         @mutex.synchronize { @thread = nil if @thread.equal?(thread) && !thread&.alive? }
         log.info('[mTLS] CertRotation stopped')
       rescue StandardError => e
@@ -67,7 +67,7 @@ module Legion
 
       def rotate!(generation: nil)
         generation ||= @mutex.synchronize { @generation }
-        new_cert = Legion::Crypt::VaultOperation.with_timeout { Legion::Crypt::Mtls.issue_cert(common_name: node_common_name) }
+        new_cert = Legion::Crypt::Vault::Operation.with_timeout { Legion::Crypt::Mtls.issue_cert(common_name: node_common_name) }
         issued_at = Time.now
         raise 'Vault PKI returned an expired certificate' unless new_cert[:expiry] > issued_at
 
@@ -133,31 +133,17 @@ module Legion
       end
 
       def renewal_window
-        return 0.5 unless defined?(Legion::Settings)
-
-        security = Legion::Settings[:security]
-        return 0.5 if security.nil?
-
-        mtls = security[:mtls] || security['mtls'] || {}
-        window = mtls[:renewal_window] || mtls['renewal_window'] || 0.5
+        window = Legion::Settings[:crypt][:mtls][:renewal_window]
         unless window.is_a?(Numeric) && window.finite? && window >= 0 && window < 1
           raise ArgumentError, 'Certificate renewal window must be finite and between zero and one (exclusive)'
         end
 
         window
-      rescue StandardError => e
-        handle_exception(e, level: :debug, operation: 'crypt.cert_rotation.renewal_window')
-        0.5
       end
 
       def node_common_name
-        return 'legion.internal' unless defined?(Legion::Settings)
-
-        name = Legion::Settings[:client]&.dig(:name) || Legion::Settings[:client]&.dig('name')
-        name || 'legion.internal'
-      rescue StandardError => e
-        handle_exception(e, level: :debug, operation: 'crypt.cert_rotation.node_common_name')
-        'legion.internal'
+        name = Legion::Settings.dig(:client, :name)
+        name.nil? ? 'legion.internal' : name
       end
 
       def emit_rotated_event(cert)

data/lib/legion/crypt/cluster_secret.rb

@@ -97,17 +97,6 @@ module Legion
         nil
       end
 
-      def force_cluster_secret
-        Legion::Settings[:crypt].fetch(:force_cluster_secret, false)
-      end
-
-      def settings_push_vault
-        vault_settings = Legion::Settings[:crypt][:vault]
-        return vault_settings[:push_cluster_secret] unless vault_settings[:push_cluster_secret].nil?
-
-        vault_settings.fetch(:push_cs_to_vault, false)
-      end
-
       def only_member?
         return true if defined?(Legion::Transport::TYPE) && Legion::Transport::TYPE == 'local'
 
@@ -130,7 +119,7 @@ module Legion
         Legion::Settings[:crypt][:cluster_secret] = value.dup.freeze
         @cluster_secret_cache = nil
         Legion::Settings[:crypt][:cs_encrypt_ready] = true
-        push_cs_to_vault if push_to_vault && settings_push_vault
+        push_cs_to_vault if push_to_vault && Legion::Settings[:crypt][:vault][:push_cluster_secret]
         log.info "Cluster secret loaded into settings push_to_vault=#{push_to_vault}"
       end
 
@@ -145,7 +134,7 @@ module Legion
       end
 
       def cluster_secret_timeout
-        timeout = Legion::Settings[:crypt].fetch(:cluster_secret_timeout, 5)
+        timeout = Legion::Settings[:crypt][:cluster_secret_timeout]
         unless timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
           raise InitializationError, 'cluster_secret_timeout must be a finite positive number'
         end
@@ -154,7 +143,7 @@ module Legion
       end
 
       def secret_length
-        length = Legion::Settings[:crypt][:cluster_length] || Legion::Settings[:crypt][:cluster_lenth] || 32
+        length = Legion::Settings[:crypt][:cluster_length]
         raise InitializationError, 'cluster_length must be a positive integer' unless length.is_a?(Integer) && length.positive?
 
         length

data/lib/legion/crypt/ed25519.rb

@@ -2,6 +2,7 @@
 
 require 'ed25519'
 require 'legion/logging/helper'
+require 'legion/crypt/settings'
 
 module Legion
   module Crypt
@@ -83,17 +84,8 @@ module Legion
 
         private
 
-        def key_prefix
-          begin
-            Legion::Settings[:crypt][:ed25519][:vault_key_prefix]
-          rescue StandardError => e
-            handle_exception(e, level: :debug, operation: 'crypt.ed25519.key_prefix')
-            nil
-          end || 'keys'
-        end
-
         def vault_key_path(agent_id)
-          normalize_kv_path("#{key_prefix}/#{agent_id}")
+          normalize_kv_path("#{Legion::Settings[:crypt][:ed25519][:vault_key_prefix]}/#{agent_id}")
         end
 
         def normalize_kv_path(path)

data/lib/legion/crypt/erasure.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/crypt/settings'
 
 module Legion
   module Crypt
@@ -9,7 +10,7 @@ module Legion
 
       class << self
         def erase_tenant(tenant_id:)
-          key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
+          key_path = "#{Legion::Settings[:crypt][:partition_keys][:vault_tenant_prefix]}/#{tenant_id}/master_key"
 
           log.info "[crypt] Erasing tenant #{tenant_id}"
           result = Legion::Crypt.delete(key_path)
@@ -25,7 +26,7 @@ module Legion
         end
 
         def verify_erasure(tenant_id:)
-          key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
+          key_path = "#{Legion::Settings[:crypt][:partition_keys][:vault_tenant_prefix]}/#{tenant_id}/master_key"
 
           data = Legion::Crypt.read(key_path, nil)
           erased = data.nil?
@@ -35,17 +36,6 @@ module Legion
           handle_exception(e, level: :warn, operation: 'crypt.erasure.verify_erasure', tenant_id: tenant_id)
           { erased: false, tenant_id: tenant_id, error: e.message }
         end
-
-        private
-
-        def tenant_prefix
-          begin
-            Legion::Settings[:crypt][:partition_keys][:vault_tenant_prefix]
-          rescue StandardError => e
-            handle_exception(e, level: :debug, operation: 'crypt.erasure.tenant_prefix')
-            nil
-          end || 'secret/data/legion/tenants'
-        end
       end
     end
   end

data/lib/legion/crypt/jwks_client.rb

@@ -6,6 +6,7 @@ require 'json'
 require 'openssl'
 require 'jwt'
 require 'legion/logging/helper'
+require 'legion/crypt/settings'
 require 'concurrent'
 
 module Legion
@@ -172,12 +173,11 @@ module Legion
         end
 
         def jwks_ssl_verify_mode
-          return OpenSSL::SSL::VERIFY_PEER unless defined?(Legion::Settings)
-
           verify = Legion::Settings[:crypt][:jwt][:jwks_tls_verify]&.to_s
           verify == 'none' ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
-        rescue StandardError
-          OpenSSL::SSL::VERIFY_PEER
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'crypt.jwks.ssl_verify_mode')
+          raise
         end
 
         def with_url_lock(jwks_url, &)

data/lib/legion/crypt/kerberos_auth.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
-require 'legion/crypt/vault_client'
+require 'legion/crypt/vault/client'
 
 module Legion
   module Crypt
@@ -94,7 +94,7 @@ module Legion
             body:    '{}',
             headers: { 'Authorization' => "Negotiate #{spnego_token}" }
           )
-          response = Legion::Crypt::VaultClient::Secret.decode(data: json)
+          response = Legion::Crypt::Vault::Client::Secret.decode(data: json)
           raise AuthError, 'Vault Kerberos auth returned no auth data' unless response&.auth
 
           auth = response.auth

data/lib/legion/crypt/ldap_auth.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
-require 'legion/crypt/vault_operation'
+require 'legion/crypt/vault/operation'
 
 module Legion
   module Crypt
@@ -14,7 +14,7 @@ module Legion
         config = clusters.fetch(cluster_name)
         log.info "LDAP login requested user=#{username} cluster=#{cluster_name}"
         client = vault_client(cluster_name)
-        secret = Legion::Crypt::VaultOperation.with_timeout do
+        secret = Legion::Crypt::Vault::Operation.with_timeout do
           client.logical.write(path: "auth/ldap/login/#{username}", data: { password: password })
         end
         auth = secret.auth

data/lib/legion/crypt/lease_manager.rb

@@ -3,7 +3,7 @@
 require 'legion/logging/helper'
 require 'singleton'
 require 'timeout'
-require 'legion/crypt/vault_operation'
+require 'legion/crypt/vault/operation'
 
 module Legion
   module Crypt
@@ -189,7 +189,7 @@ module Legion
 
       def start_renewal_thread
         previous = @state_mutex.synchronize { @renewal_thread if @renewal_generation != @generation }
-        Legion::Crypt::VaultOperation.with_timeout { previous.join } if previous&.alive?
+        Legion::Crypt::Vault::Operation.with_timeout { previous.join } if previous&.alive?
         @state_mutex.synchronize do
           return if @renewal_thread&.alive? || @stopped
           return if Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
@@ -218,7 +218,7 @@ module Legion
       end
 
       def shutdown(deadline: nil)
-        deadline ||= monotonic_now + Legion::Crypt::VaultOperation::SHUTDOWN_TIMEOUT
+        deadline ||= monotonic_now + Legion::Crypt::Vault::Operation::SHUTDOWN_TIMEOUT
         request_stop
         @state_mutex.synchronize do
           @active_leases.clear
@@ -376,7 +376,7 @@ module Legion
 
       def with_lease_operation(name:, deadline: nil, **)
         lock = @state_mutex.synchronize { @lease_locks[name] ||= Mutex.new }
-        Legion::Crypt::VaultOperation.with_timeout(deadline: deadline) do |operation_deadline|
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) do |operation_deadline|
           lock.synchronize { yield operation_deadline }
         end
       end
@@ -510,7 +510,7 @@ module Legion
         safe_to_retire = !handoff[:attempted_reconnect] || !lifecycle_current?(generation: generation, active: active)
         if handoff[:attempted_reconnect] && restored
           begin
-            safe_to_retire = Legion::Crypt::VaultOperation.with_timeout(deadline: context[:deadline]) do
+            safe_to_retire = Legion::Crypt::Vault::Operation.with_timeout(deadline: context[:deadline]) do
               trigger_reconnect(name, generation: generation, active: active)
             end
           rescue StandardError => e
@@ -602,7 +602,7 @@ module Legion
         end
         return unless entry
 
-        Legion::Crypt::VaultOperation.with_timeout(deadline: deadline) { entry[:client].sys.revoke(lease_id: entry[:lease_id]) }
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) { entry[:client].sys.revoke(lease_id: entry[:lease_id]) }
         @state_mutex.synchronize { @owned_leases.delete(key) if @owned_leases[key].equal?(entry) }
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.lease_manager.revoke_owned_lease', lease_name: entry&.dig(:name))
@@ -620,7 +620,7 @@ module Legion
         thread = request_stop
         return unless thread
 
-        Legion::Crypt::VaultOperation.with_timeout(deadline: deadline) { thread.join }
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) { thread.join }
         @state_mutex.synchronize { @renewal_thread = nil if @renewal_thread.equal?(thread) }
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.lease_manager.stop_renewal_thread')

data/lib/legion/crypt/mtls.rb

@@ -1,47 +1,31 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/crypt/settings'
 require 'socket'
 
 module Legion
   module Crypt
     module Mtls
-      DEFAULT_PKI_PATH = 'pki/issue/legion-internal'
-      DEFAULT_TTL      = '24h'
       extend Legion::Logging::Helper
 
       class << self
         def enabled?
-          security = safe_security_settings
-          return false if security.nil?
-
-          mtls = security[:mtls] || security['mtls']
-          return false if mtls.nil?
-
-          mtls[:enabled] || mtls['enabled'] || false
-        end
-
-        def pki_path
-          security = safe_security_settings
-          return DEFAULT_PKI_PATH if security.nil?
-
-          mtls = security[:mtls] || security['mtls'] || {}
-          mtls[:vault_pki_path] || mtls['vault_pki_path'] || DEFAULT_PKI_PATH
+          Legion::Settings[:crypt][:mtls][:enabled] == true
         end
 
-        def issue_cert(common_name:, ttl: nil)
-          resolved_ttl = ttl || cert_ttl_setting || DEFAULT_TTL
+        def issue_cert(common_name:, alt_names: '', ttl: nil, **)
+          pki_path = Legion::Settings[:crypt][:mtls][:vault_pki_path]
+          resolved_ttl = ttl.nil? ? Legion::Settings[:crypt][:mtls][:cert_ttl] : ttl
           log.info "[mTLS] certificate issue requested common_name=#{common_name} ttl=#{resolved_ttl}"
 
           response = Legion::Crypt.vault_client.logical.write(
             path: pki_path,
-            data: { common_name: common_name, ttl: resolved_ttl, ip_sans: local_ip, alt_names: '' }
+            data: { common_name: common_name, ttl: resolved_ttl, ip_sans: local_ip, alt_names: alt_names }
           )
-
           raise "Vault PKI returned nil for #{pki_path} (common_name=#{common_name})" if response.nil?
 
           data = response.data
-
           {
             cert:     data[:certificate],
             key:      data[:private_key],
@@ -54,34 +38,12 @@ module Legion
           raise
         end
 
-        def local_ip
+        def local_ip(**)
           Socket.ip_address_list.find { |a| a.ipv4? && !a.ipv4_loopback? }&.ip_address || '127.0.0.1'
-        rescue StandardError => e
+        rescue SocketError, SystemCallError, IOError => e
           handle_exception(e, level: :warn, operation: 'crypt.mtls.local_ip')
           '127.0.0.1'
         end
-
-        private
-
-        def safe_security_settings
-          return nil unless defined?(Legion::Settings)
-
-          Legion::Settings[:security]
-        rescue StandardError => e
-          handle_exception(e, level: :debug, operation: 'crypt.mtls.safe_security_settings')
-          nil
-        end
-
-        def cert_ttl_setting
-          security = safe_security_settings
-          return nil if security.nil?
-
-          mtls = security[:mtls] || security['mtls'] || {}
-          mtls[:cert_ttl] || mtls['cert_ttl']
-        rescue StandardError => e
-          handle_exception(e, level: :debug, operation: 'crypt.mtls.cert_ttl_setting')
-          nil
-        end
       end
     end
   end

data/lib/legion/crypt/partition_keys.rb

@@ -2,6 +2,7 @@
 
 require 'openssl'
 require 'legion/logging/helper'
+require 'legion/crypt/settings'
 
 module Legion
   module Crypt
@@ -10,12 +11,7 @@ module Legion
 
       class << self
         def derive_key(master_key:, tenant_id:, context: nil)
-          context ||= begin
-            Legion::Settings[:crypt][:partition_keys][:derivation_context]
-          rescue StandardError => e
-            handle_exception(e, level: :debug, operation: 'crypt.partition_keys.derivation_context', tenant_id: tenant_id)
-            nil
-          end || 'legion-partition'
+          context = Legion::Settings[:crypt][:partition_keys][:derivation_context] if context.nil?
           log.debug "PartitionKeys deriving key for tenant #{tenant_id}"
           salt = OpenSSL::Digest::SHA256.digest(tenant_id.to_s)
           OpenSSL::KDF.hkdf(master_key, salt: salt, info: context, length: 32, hash: 'SHA256')

data/lib/legion/crypt/settings.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/settings'
 
 module Legion
   module Crypt
@@ -17,6 +18,15 @@ module Legion
         }
       end
 
+      def self.mtls
+        {
+          enabled:        false,
+          vault_pki_path: 'pki/issue/legion-internal',
+          cert_ttl:       '24h',
+          renewal_window: 0.5
+        }
+      end
+
       def self.spiffe
         {
           enabled:             false,
@@ -30,14 +40,19 @@ module Legion
 
       def self.default
         {
-          vault:            vault,
-          jwt:              jwt,
-          tls:              tls,
-          cs_encrypt_ready: false,
-          dynamic_keys:     true,
-          cluster_secret:   nil,
-          save_private_key: true,
-          read_private_key: true
+          vault:                  vault,
+          jwt:                    jwt,
+          tls:                    tls,
+          mtls:                   mtls,
+          cs_encrypt_ready:       false,
+          dynamic_keys:           true,
+          cluster_secret:         nil,
+          cluster_length:         32,
+          cluster_secret_timeout: 5,
+          save_private_key:       true,
+          read_private_key:       true,
+          ed25519:                { vault_key_prefix: 'keys' },
+          partition_keys:         { derivation_context: 'legion-partition', vault_tenant_prefix: 'secret/data/legion/tenants' }
         }
       end
 
@@ -87,16 +102,4 @@ module Legion
   end
 end
 
-begin
-  if Legion.const_defined?('Settings')
-    Legion::Settings.merge_settings('crypt', Legion::Crypt::Settings.default)
-    Legion::Crypt::Settings.log.info('Legion::Crypt settings defaults merged')
-  end
-rescue StandardError => e
-  if Legion::Crypt::Settings.respond_to?(:handle_exception)
-    Legion::Crypt::Settings.handle_exception(e, level: :fatal, operation: 'crypt.settings.merge_defaults')
-  else
-    puts e.message
-    puts e.backtrace
-  end
-end
+Legion::Settings.register_library(:crypt, Legion::Crypt::Settings.default)

data/lib/legion/crypt/spiffe/svid_rotation.rb

@@ -130,16 +130,13 @@ module Legion
         end
 
         def renewal_window
-          return SVID_RENEWAL_RATIO unless defined?(Legion::Settings)
-
-          security = Legion::Settings[:security]
-          return SVID_RENEWAL_RATIO if security.nil?
+          window = Legion::Settings.dig(:security, :spiffe, :renewal_window)
+          window = SVID_RENEWAL_RATIO if window.nil?
+          unless window.is_a?(Numeric) && window.finite? && window >= 0 && window < 1
+            raise ArgumentError, 'SVID renewal window must be finite and between zero and one (exclusive)'
+          end
 
-          spiffe = security[:spiffe] || security['spiffe'] || {}
-          spiffe[:renewal_window] || spiffe['renewal_window'] || SVID_RENEWAL_RATIO
-        rescue StandardError => e
-          handle_exception(e, level: :debug, operation: 'crypt.spiffe.svid_rotation.renewal_window')
-          SVID_RENEWAL_RATIO
+          window
         end
       end
     end

data/lib/legion/crypt/spiffe.rb

@@ -1,8 +1,12 @@
 # frozen_string_literal: true
 
-require 'legion/logging/helper'
 require 'uri'
 require 'openssl'
+require 'legion/logging/helper'
+require 'legion/crypt/settings'
+require 'legion/crypt/spiffe/workload_api_client'
+require 'legion/crypt/spiffe/svid_rotation'
+require 'legion/crypt/spiffe/identity_helpers'
 
 module Legion
   module Crypt
@@ -10,7 +14,7 @@ module Legion
       SPIFFE_SCHEME = 'spiffe'
       DEFAULT_SOCKET_PATH = '/tmp/spire-agent/public/api.sock'
       DEFAULT_TRUST_DOMAIN = 'legion.internal'
-      SVID_RENEWAL_RATIO   = 0.5
+      SVID_RENEWAL_RATIO = 0.5
 
       class Error < StandardError; end
       class InvalidSpiffeIdError < Error; end
@@ -80,50 +84,30 @@ module Legion
           parse_id(spiffe_id_string)
           true
         rescue InvalidSpiffeIdError => e
-          handle_exception(e, level: :debug, operation: 'crypt.spiffe.valid_id', spiffe_id: spiffe_id_string)
+          handle_exception(e, level: :warn, operation: 'crypt.spiffe.valid_id', spiffe_id: spiffe_id_string)
           false
         end
 
         def enabled?
-          security = safe_security_settings
-          return false if security.nil?
-
-          spiffe = security[:spiffe] || security['spiffe']
-          return false if spiffe.nil?
-
-          spiffe[:enabled] || spiffe['enabled'] || false
+          Legion::Settings.dig(:security, :spiffe, :enabled) == true
         end
 
         def socket_path
-          security = safe_security_settings
-          return DEFAULT_SOCKET_PATH if security.nil?
-
-          spiffe = security[:spiffe] || security['spiffe'] || {}
-          spiffe[:socket_path] || spiffe['socket_path'] || DEFAULT_SOCKET_PATH
+          path = Legion::Settings.dig(:security, :spiffe, :socket_path)
+          path.nil? ? DEFAULT_SOCKET_PATH : path
         end
 
         def trust_domain
-          security = safe_security_settings
-          return DEFAULT_TRUST_DOMAIN if security.nil?
-
-          spiffe = security[:spiffe] || security['spiffe'] || {}
-          spiffe[:trust_domain] || spiffe['trust_domain'] || DEFAULT_TRUST_DOMAIN
+          domain = Legion::Settings.dig(:security, :spiffe, :trust_domain)
+          domain.nil? ? DEFAULT_TRUST_DOMAIN : domain
         end
 
         def workload_id
-          security = safe_security_settings
-          return nil if security.nil?
-
-          spiffe = security[:spiffe] || security['spiffe'] || {}
-          spiffe[:workload_id] || spiffe['workload_id']
+          Legion::Settings.dig(:security, :spiffe, :workload_id)
         end
 
         def allow_x509_fallback?
-          security = safe_security_settings
-          return false if security.nil?
-
-          spiffe = security[:spiffe] || security['spiffe'] || {}
-          spiffe[:allow_x509_fallback] || spiffe['allow_x509_fallback'] || false
+          Legion::Settings.dig(:security, :spiffe, :allow_x509_fallback) == true
         end
 
         private
@@ -138,15 +122,6 @@ module Legion
 
           raise InvalidSpiffeIdError, "SPIFFE ID must not contain userinfo, port, query, or fragment in '#{raw}'"
         end
-
-        def safe_security_settings
-          return nil unless defined?(Legion::Settings)
-
-          Legion::Settings[:security]
-        rescue StandardError => e
-          handle_exception(e, level: :debug, operation: 'crypt.spiffe.safe_security_settings')
-          nil
-        end
       end
     end
   end

data/lib/legion/crypt/token_renewer.rb

@@ -2,8 +2,8 @@
 
 require 'legion/logging/helper'
 require 'legion/crypt/kerberos_auth'
-require 'legion/crypt/vault_operation'
-require 'legion/crypt/vault_client'
+require 'legion/crypt/vault/operation'
+require 'legion/crypt/vault/client'
 
 module Legion
   module Crypt
@@ -57,7 +57,7 @@ module Legion
       end
 
       def stop(deadline: nil)
-        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + VaultOperation::SHUTDOWN_TIMEOUT
+        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::Vault::Operation::SHUTDOWN_TIMEOUT
         @state_mutex.synchronize do
           return if @stopping
 
@@ -86,7 +86,7 @@ module Legion
         deadline = @state_mutex.synchronize do
           ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + (@expires_at - Time.now) if @expires_at
         end
-        VaultOperation.with_timeout(deadline: deadline) do
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) do
           result = @vault_client.auth_token.renew_self
           @state_mutex.synchronize do
             return false unless active_generation?(generation: generation)
@@ -133,7 +133,7 @@ module Legion
             true
           end
         end
-        VaultOperation.with_timeout do
+        Legion::Crypt::Vault::Operation.with_timeout do
           result = Legion::Crypt::KerberosAuth.login(
             vault_client:      @vault_client,
             service_principal: krb_config[:service_principal],
@@ -307,7 +307,7 @@ module Legion
         end
         return unless owned_token
 
-        VaultOperation.with_timeout(deadline: deadline) { @vault_client.auth_token.revoke_self }
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) { @vault_client.auth_token.revoke_self }
         log.info("TokenRenewer[#{@cluster_name}]: Vault token revoked")
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.token_renewer.revoke_token', cluster_name: @cluster_name)