legion-crypt 1.5.38 → 1.5.42

data/lib/legion/crypt/vault/entity.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+require 'legion/crypt/vault/client'
+require 'legion/crypt/lease_manager'
+
+module Legion
+  module Crypt
+    module Vault
+      module Entity
+        extend Legion::Logging::Helper
+
+        # Create or lookup a Vault entity for a Legion principal.
+        # Returns the Vault entity ID string, or nil on failure.
+        def self.ensure_entity(principal_id:, canonical_name:, metadata: {})
+          existing = find_by_name(canonical_name: canonical_name)
+          return existing if existing
+
+          response = Legion::Crypt::LeaseManager.instance.vault_logical.write(
+            path: 'identity/entity',
+            data: {
+              name:     "legion-#{canonical_name}",
+              metadata: metadata.merge(
+                legion_principal_id:   principal_id,
+                legion_canonical_name: canonical_name,
+                managed_by:            'legion'
+              )
+            }
+          )
+          extract_id(response)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_entity.ensure_entity', canonical_name: canonical_name)
+          nil
+        end
+
+        # Create an alias linking an auth method mount to the entity.
+        # Idempotent — swallows "already exists" 4xx errors.
+        def self.ensure_alias(entity_id:, mount_accessor:, alias_name:)
+          Legion::Crypt::LeaseManager.instance.vault_logical.write(
+            path: 'identity/entity-alias',
+            data: { name: alias_name, canonical_id: entity_id, mount_accessor: mount_accessor }
+          )
+        rescue Legion::Crypt::Vault::HTTPClientError => e
+          if e.message.include?('already exists')
+            log.debug 'Vault entity alias already exists (idempotent)'
+          else
+            handle_exception(e, level: :warn, operation: 'crypt.vault_entity.ensure_alias', alias_name: alias_name)
+          end
+          nil
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_entity.ensure_alias', alias_name: alias_name)
+          nil
+        end
+
+        # Look up a Vault entity by its Legion canonical name.
+        # Returns the Vault entity ID string, or nil if not found.
+        def self.find_by_name(canonical_name:)
+          response = Legion::Crypt::LeaseManager.instance.vault_logical.read(path: "identity/entity/name/legion-#{canonical_name}")
+          extract_id(response)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_entity.find_by_name', canonical_name: canonical_name)
+          nil
+        end
+
+        # ---------------------------------------------------------------------------
+        # Private helpers
+        # ---------------------------------------------------------------------------
+
+        # Extract the entity ID from the client's symbol-keyed response data.
+        def self.extract_id(response)
+          data = response&.data
+          return nil unless data
+
+          data[:id]
+        end
+        private_class_method :extract_id
+      end
+    end
+  end
+end

data/lib/legion/crypt/vault/jwt_auth.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+require 'legion/crypt/vault/client'
+
+module Legion
+  module Crypt
+    # Vault JWT auth backend integration.
+    #
+    # Allows Legion workers to authenticate to Vault using JWT tokens
+    # via Vault's JWT/OIDC auth method. The worker presents a signed JWT
+    # and receives a Vault token with policies scoped to the worker's role.
+    #
+    # Vault config prerequisites:
+    #   vault auth enable jwt
+    #   vault write auth/jwt/config jwks_url="..." (or bound_issuer + jwt_validation_pubkeys)
+    #   vault write auth/jwt/role/legion-worker bound_audiences="legion" ...
+    module Vault
+      module JwtAuth
+        DEFAULT_AUTH_PATH = 'auth/jwt/login'
+        DEFAULT_ROLE      = 'legion-worker'
+
+        class AuthError < StandardError; end
+
+        extend Legion::Logging::Helper
+
+        # Authenticate to Vault using a JWT token.
+        # Returns a Vault token string on success.
+        #
+        # @param jwt [String] Signed JWT token (issued by Legion or Entra ID)
+        # @param role [String] Vault JWT auth role name (default: 'legion-worker')
+        # @param auth_path [String] Vault auth mount path (default: 'auth/jwt/login')
+        # @return [Hash] { token:, lease_duration:, policies:, metadata: }
+        def self.login(jwt:, role: DEFAULT_ROLE, auth_path: DEFAULT_AUTH_PATH)
+          raise AuthError, 'Vault is not connected' unless Legion::Crypt.vault_connected?
+
+          log.info "[crypt:vault_jwt] authenticating role=#{role} auth_path=#{auth_path}"
+          response = Legion::Crypt.vault_client.logical.write(path: auth_path, data: { role: role, jwt: jwt })
+
+          raise AuthError, 'Vault JWT auth returned no auth data' unless response&.auth
+
+          {
+            token:          response.auth.client_token,
+            lease_duration: response.auth.lease_duration,
+            renewable:      response.auth.renewable?,
+            policies:       response.auth.policies,
+            metadata:       response.auth.metadata
+          }
+        rescue Legion::Crypt::Vault::HTTPClientError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path,
+                              category: 'client_error')
+          raise AuthError, "Vault JWT auth failed: #{e.message}"
+        rescue Legion::Crypt::Vault::HTTPServerError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path,
+                              category: 'server_error')
+          raise AuthError, "Vault server error during JWT auth: #{e.message}"
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path)
+          raise if e.is_a?(AuthError)
+
+          raise AuthError, "Vault JWT auth failed: #{e.message}"
+        end
+
+        # Authenticate and set the Vault client token for subsequent operations.
+        # This replaces the current Vault token with the JWT-authenticated one.
+        #
+        # @return [Hash] Same as login
+        def self.login!(jwt:, role: DEFAULT_ROLE, auth_path: DEFAULT_AUTH_PATH)
+          generation = Legion::Crypt.vault_auth_generation
+          client = Legion::Crypt.vault_client
+          config = Legion::Crypt.cluster || Legion::Settings[:crypt][:vault]
+          result = login(jwt: jwt, role: role, auth_path: auth_path)
+          Legion::Crypt.install_vault_grant(client: client, config: config, grant: result, auth_method: 'jwt', generation: generation)
+          log.info "[crypt:vault_jwt] authenticated via JWT auth, policies=#{result[:policies].join(',')}"
+          result
+        end
+
+        # Issue a Legion JWT and use it to authenticate to Vault in one step.
+        # Convenience method for workers that need Vault access.
+        #
+        # @param worker_id [String] Digital worker ID
+        # @param owner_msid [String] Worker's owner MSID
+        # @param role [String] Vault JWT auth role name
+        # @return [Hash] Same as login
+        def self.worker_login(worker_id:, owner_msid:, role: DEFAULT_ROLE)
+          log.info "[crypt:vault_jwt] worker login requested role=#{role} worker_id=#{worker_id}"
+          jwt = Legion::Crypt::JWT.issue(
+            { worker_id: worker_id, sub: owner_msid, scope: 'vault', aud: 'legion' },
+            signing_key: Legion::Crypt.cluster_secret,
+            ttl:         300,
+            issuer:      'legion'
+          )
+
+          login(jwt: jwt, role: role)
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/vault/kerberos_auth.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+require 'legion/crypt/vault/client'
+
+module Legion
+  module Crypt
+    module Vault
+      module KerberosAuth
+        DEFAULT_AUTH_PATH = 'auth/kerberos/login'
+
+        class AuthError < StandardError; end
+
+        extend Legion::Logging::Helper
+
+        def self.login(spnego_token:, auth_path: DEFAULT_AUTH_PATH)
+          raise AuthError, 'Vault is not connected' unless Legion::Crypt.vault_connected?
+
+          log.info "[crypt:vault_kerberos] login requested auth_path=#{auth_path}"
+          data = Legion::Crypt.vault_client.put(
+            path: auth_path, body: '{}', headers: { 'Authorization' => "Negotiate #{spnego_token}" }
+          )
+          response = Legion::Crypt::Vault::Client::Secret.decode(data: data)
+          raise AuthError, 'Vault Kerberos auth returned no auth data' unless response&.auth
+
+          {
+            token:          response.auth.client_token,
+            lease_duration: response.auth.lease_duration,
+            renewable:      response.auth.renewable?,
+            policies:       response.auth.policies,
+            metadata:       response.auth.metadata
+          }
+        rescue Legion::Crypt::Vault::HTTPClientError => e
+          handle_exception(e, level: :warn, operation: 'crypt.vault_kerberos_auth.login', auth_path: auth_path)
+          raise AuthError, "Vault Kerberos auth failed: #{e.message}"
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.vault_kerberos_auth.login', auth_path: auth_path)
+          raise
+        end
+
+        def self.login!(spnego_token:, auth_path: DEFAULT_AUTH_PATH)
+          generation = Legion::Crypt.vault_auth_generation
+          client = Legion::Crypt.vault_client
+          config = Legion::Crypt.cluster || Legion::Settings[:crypt][:vault]
+          result = login(spnego_token: spnego_token, auth_path: auth_path)
+          Legion::Crypt.install_vault_grant(client: client, config: config, grant: result, auth_method: 'kerberos', generation: generation)
+          log.info "[crypt:vault_kerberos] authenticated via Kerberos auth, policies=#{result[:policies].join(',')}"
+          result
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/vault/operation.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'timeout'
+require 'legion/crypt/settings'
+
+module Legion
+  module Crypt
+    module Vault
+      module Operation
+        DEFAULT_TIMEOUT = 5
+        SHUTDOWN_TIMEOUT = 10
+
+        def self.with_timeout(deadline: nil, **)
+          timeout = Legion::Settings[:crypt][:vault][:operation_timeout]
+          raise ArgumentError, 'Vault operation_timeout must be a finite positive number' unless timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
+
+          if deadline
+            remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+            raise Timeout::Error, 'Vault operation deadline expired' unless remaining.positive?
+
+            timeout = [timeout, remaining].min
+          end
+          operation_deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + timeout
+          Timeout.timeout(timeout) { yield(operation_deadline) }
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/vault.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
-require 'legion/crypt/vault_operation'
-require 'legion/crypt/vault_client'
+require 'legion/crypt/vault/operation'
+require 'legion/crypt/vault/client'
 
 module Legion
   module Crypt
@@ -11,15 +11,10 @@ module Legion
 
       attr_accessor :sessions
 
-      def settings
-        Legion::Settings[:crypt][:vault]
-      end
-
       def connect_vault
         return unless start_session_tracking
 
         configuration = Legion::Settings[:crypt][:vault]
-        configuration[:token] = ENV['VAULT_DEV_ROOT_TOKEN_ID'] if ENV.key? 'VAULT_DEV_ROOT_TOKEN_ID'
         return nil if configuration[:token].nil?
 
         client = vault_client
@@ -119,7 +114,7 @@ module Legion
       end
 
       def close_sessions(deadline: nil)
-        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + VaultOperation::SHUTDOWN_TIMEOUT
+        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::Vault::Operation::SHUTDOWN_TIMEOUT
         pending = session_mutex.synchronize do
           @sessions_stopped = true
           @session_generation = (@session_generation || 0) + 1
@@ -132,7 +127,7 @@ module Legion
         pending.each do |session|
           break if ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) >= deadline
 
-          VaultOperation.with_timeout(deadline: deadline) { close_session(session: session) }
+          Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) { close_session(session: session) }
           closed << session
         rescue StandardError => e
           handle_exception(e, level: :error, operation: 'crypt.vault.close_session')
@@ -175,7 +170,7 @@ module Legion
         pending.each do |session|
           break unless session_maintenance_active?(generation: generation)
 
-          VaultOperation.with_timeout { renew_session(session: session) }
+          Legion::Crypt::Vault::Operation.with_timeout { renew_session(session: session) }
           renewed << session
         rescue StandardError => e
           handle_exception(e, level: :error, operation: 'crypt.vault.renew_session')
@@ -192,7 +187,7 @@ module Legion
         connected_clusters.each_key do |name|
           break unless session_maintenance_active?(generation: generation)
 
-          VaultOperation.with_timeout { vault_client(name).auth_token.renew_self }
+          Legion::Crypt::Vault::Operation.with_timeout { vault_client(name).auth_token.renew_self }
           renewed << name
           log.info "Vault token renewed for cluster #{name}"
         rescue StandardError => e

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.38'
+    VERSION = '1.5.42'
   end
 end

data/lib/legion/crypt.rb

@@ -3,14 +3,16 @@
 require 'openssl'
 require 'base64'
 require 'legion/logging/helper'
+require 'legion/settings'
+
 require 'legion/crypt/version'
 require 'legion/crypt/settings'
 require 'legion/crypt/cipher'
 require 'legion/crypt/jwt'
-require 'legion/crypt/vault_jwt_auth'
+require 'legion/crypt/vault/jwt_auth'
 require 'legion/crypt/lease_manager'
-require 'legion/crypt/vault_operation'
-require 'legion/crypt/vault_cluster'
+require 'legion/crypt/vault/operation'
+require 'legion/crypt/vault/cluster'
 require 'legion/crypt/vault'
 require 'legion/crypt/ldap_auth'
 require 'legion/crypt/token_renewer'
@@ -18,13 +20,10 @@ require 'legion/crypt/helper'
 require 'legion/crypt/mtls'
 require 'legion/crypt/cert_rotation'
 require 'legion/crypt/spiffe'
-require 'legion/crypt/spiffe/workload_api_client'
-require 'legion/crypt/spiffe/svid_rotation'
-require 'legion/crypt/spiffe/identity_helpers'
 
 module Legion
   module Crypt
-    extend Legion::Crypt::VaultCluster
+    extend Legion::Crypt::Vault::Cluster
     extend Legion::Crypt::LdapAuth
 
     RMQ_ROLE_MAP = {
@@ -33,6 +32,10 @@ module Legion
       infra:  'legionio-infra'
     }.freeze
 
+    POSTGRES_ROLE_MAP = {
+      infra: 'infra'
+    }.freeze
+
     class << self
       attr_reader :sessions, :stopping
 
@@ -41,29 +44,25 @@ module Legion
 
       include Legion::Crypt::Vault
 
-      def vault_settings
-        Legion::Settings[:crypt][:vault]
-      end
-
-      def kerberos_principal
-        KerberosAuth.kerberos_principal
+      def kerberos_principal(**)
+        Legion::Crypt::KerberosAuth.kerberos_principal
       end
 
       def spiffe_svid
         @svid_rotation&.current_svid
       end
 
-      def fetch_svid
-        @workload_client ||= Spiffe::WorkloadApiClient.new
+      def fetch_svid(**)
+        @workload_client ||= Legion::Crypt::Spiffe::WorkloadApiClient.new
         @workload_client.fetch_x509_svid
       end
 
-      def fetch_jwt_svid(audience:)
-        @workload_client ||= Spiffe::WorkloadApiClient.new
+      def fetch_jwt_svid(audience:, **)
+        @workload_client ||= Legion::Crypt::Spiffe::WorkloadApiClient.new
         @workload_client.fetch_jwt_svid(audience: audience)
       end
 
-      def start
+      def start(mode: nil, **)
         lifecycle_mutex.synchronize do
           if @started || @stopping
             log.info 'Legion::Crypt start ignored because the lifecycle is running or stopping'
@@ -72,7 +71,7 @@ module Legion
 
           log.info 'Legion::Crypt startup initiated'
           log.debug 'Legion::Crypt start requested'
-          if settings[:save_private_key]
+          if Legion::Settings[:crypt][:save_private_key]
             key = private_key
             ::File.open('./legionio.key', ::File::WRONLY | ::File::CREAT, 0o600) do |file|
               file.chmod(0o600)
@@ -83,15 +82,15 @@ module Legion
           @token_renewers ||= []
           start_session_tracking
 
-          if vault_settings[:clusters]&.any?
-            log.info "Legion::Crypt connecting #{vault_settings[:clusters].size} Vault cluster(s)"
+          if Legion::Settings[:crypt][:vault][:clusters].any?
+            log.info "Legion::Crypt connecting #{Legion::Settings[:crypt][:vault][:clusters].size} Vault cluster(s)"
             connect_all_clusters
           else
-            log.info 'Legion::Crypt connecting primary Vault client' unless settings[:vault][:token].nil?
-            connect_vault unless settings[:vault][:token].nil?
+            log.info 'Legion::Crypt connecting primary Vault client' unless Legion::Settings[:crypt][:vault][:token].nil?
+            connect_vault unless Legion::Settings[:crypt][:vault][:token].nil?
           end
           start_token_renewers
-          start_lease_manager
+          start_lease_manager(mode: mode)
           start_svid_rotation
           @started = true
           log.info 'Legion::Crypt startup completed'
@@ -121,31 +120,19 @@ module Legion
         end
       end
 
-      def settings
-        if Legion.const_defined?('Settings')
-          Legion::Settings[:crypt]
-        else
-          Legion::Crypt::Settings.default
-        end
-      end
-
-      def jwt_settings
-        settings[:jwt] || Legion::Crypt::Settings.jwt
-      end
-
       def dynamic_rmq_creds?
-        Legion::Settings.dig(:crypt, :vault, :dynamic_rmq_creds) == true
+        Legion::Settings[:crypt][:vault][:dynamic_rmq_creds] == true
       end
 
-      def fetch_bootstrap_rmq_creds
+      def fetch_bootstrap_rmq_creds(**)
         return unless vault_connected? && dynamic_rmq_creds?
 
         Legion::Settings.merge_settings('transport', Legion::Transport::Settings.default) if defined?(Legion::Transport::Settings)
 
-        response = LeaseManager.instance.vault_logical.read(path: 'rabbitmq/creds/legionio-bootstrap')
+        response = Legion::Crypt::LeaseManager.instance.vault_logical.read(path: 'rabbitmq/creds/legionio-bootstrap')
         return unless response&.data
 
-        bootstrap_lease_ttl = Legion::Settings.dig(:crypt, :vault, :bootstrap_lease_ttl).to_i
+        bootstrap_lease_ttl = Legion::Settings[:crypt][:vault][:bootstrap_lease_ttl].to_i
         bootstrap_lease_ttl = 300 if bootstrap_lease_ttl <= 0
 
         @bootstrap_lease_id = response.lease_id
@@ -167,18 +154,17 @@ module Legion
         conn[:password] = password
 
         log.info "Bootstrap RMQ credentials acquired (lease: #{@bootstrap_lease_id[0..7]}...)"
-      rescue StandardError => e
+      rescue IOError, SystemCallError, Timeout::Error, Faraday::Error, Legion::Crypt::Vault::HTTPError => e
         handle_exception(e, level: :warn, operation: 'crypt.fetch_bootstrap_rmq_creds')
-        log.warn "Bootstrap RMQ credential fetch failed: #{e.message}"
       end
 
-      def swap_to_identity_creds(mode:)
+      def swap_to_identity_creds(mode:, **)
         return unless vault_connected? && dynamic_rmq_creds?
         return if mode == :lite
 
         role = RMQ_ROLE_MAP.fetch(mode, "legionio-#{mode}")
-        manager = LeaseManager.instance
-        response = Legion::Crypt::VaultOperation.with_timeout { manager.vault_logical.read(path: "rabbitmq/creds/#{role}") }
+        manager = Legion::Crypt::LeaseManager.instance
+        response = Legion::Crypt::Vault::Operation.with_timeout { manager.vault_logical.read(path: "rabbitmq/creds/#{role}") }
         raise "Failed to fetch identity-scoped RMQ creds for role #{role}" unless response
 
         settings = Legion::Settings.loader.settings
@@ -199,56 +185,47 @@ module Legion
         )
         raise 'Identity credential handoff failed — bootstrap lease NOT revoked' unless installed
 
-        Legion::Crypt::VaultOperation.with_timeout { revoke_bootstrap_lease }
+        Legion::Crypt::Vault::Operation.with_timeout { revoke_bootstrap_lease }
       end
 
-      def revoke_bootstrap_lease
+      def revoke_bootstrap_lease(**)
         return unless @bootstrap_lease_id
 
-        LeaseManager.instance.vault_sys.revoke(lease_id: @bootstrap_lease_id)
+        Legion::Crypt::LeaseManager.instance.vault_sys.revoke(lease_id: @bootstrap_lease_id)
         log.info "Bootstrap RMQ lease revoked (#{@bootstrap_lease_id[0..7]}...)"
         @bootstrap_lease_id      = nil
         @bootstrap_lease_expires = nil
-      rescue StandardError => e
+      rescue IOError, SystemCallError, Timeout::Error, Faraday::Error, Legion::Crypt::Vault::HTTPError => e
         handle_exception(e, level: :warn, operation: 'crypt.revoke_bootstrap_lease')
-        log.warn "Bootstrap lease revocation failed: #{e.message} — lease will expire naturally"
         @bootstrap_lease_id      = nil
         @bootstrap_lease_expires = nil
       end
 
-      def vault_connected?
-        return connected_clusters.any? if settings.dig(:vault, :clusters)&.any?
+      def vault_connected?(**)
+        return connected_clusters.any? if Legion::Settings[:crypt][:vault][:clusters].any?
 
-        return true if settings.dig(:vault, :connected) == true
-        return true if respond_to?(:connected_clusters) && connected_clusters.any?
-
-        false
-      rescue StandardError => e
-        handle_exception(e, level: :debug, operation: 'crypt.vault_connected?')
-        false
+        Legion::Settings[:crypt][:vault][:connected] == true
       end
 
       def issue_token(payload = {}, ttl: nil, algorithm: nil)
-        jwt = jwt_settings
+        jwt = Legion::Settings[:crypt][:jwt]
         algo = algorithm || jwt[:default_algorithm]
         token_ttl = ttl || jwt[:default_ttl]
+        signing_key = algo == 'RS256' ? private_key : Legion::Settings[:crypt][:cluster_secret]
 
-        signing_key = algo == 'RS256' ? private_key : settings[:cluster_secret]
-
-        Legion::Crypt::JWT.issue(payload, signing_key: signing_key, algorithm: algo, ttl: token_ttl,
-                                          issuer: jwt[:issuer])
+        Legion::Crypt::JWT.issue(payload, signing_key: signing_key, algorithm: algo, ttl: token_ttl, issuer: jwt[:issuer])
       end
 
       def verify_token(token, algorithm: nil)
-        jwt = jwt_settings
+        jwt = Legion::Settings[:crypt][:jwt]
         algo = algorithm || jwt[:default_algorithm]
 
-        verification_key = algo == 'RS256' ? OpenSSL::PKey::RSA.new(public_key) : settings[:cluster_secret]
+        verification_key = algo == 'RS256' ? OpenSSL::PKey::RSA.new(public_key) : Legion::Settings[:crypt][:cluster_secret]
 
         Legion::Crypt::JWT.verify(token, verification_key: verification_key, algorithm: algo,
-                                         verify_expiration: jwt[:verify_expiration],
-                                         verify_issuer: jwt[:verify_issuer],
-                                         issuer: jwt[:issuer])
+                                  verify_expiration: jwt[:verify_expiration],
+                                  verify_issuer: jwt[:verify_issuer],
+                                  issuer: jwt[:issuer])
       end
 
       def verify_external_token(token, jwks_url:, **)
@@ -265,7 +242,7 @@ module Legion
           @started = false
           true
         end
-        deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::VaultOperation::SHUTDOWN_TIMEOUT
+        deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::Vault::Operation::SHUTDOWN_TIMEOUT
         manager = Legion::Crypt::LeaseManager.instance
         [manager, *(@token_renewers || [])].each do |worker|
           worker.request_stop
@@ -298,9 +275,9 @@ module Legion
 
       private
 
-      def start_lease_manager
-        leases = settings.dig(:vault, :leases) || {}
-        vault_ok = connected_clusters.any? || settings.dig(:vault, :connected)
+      def start_lease_manager(mode: nil)
+        leases = postgresql_leases_for_mode(leases: Legion::Settings[:crypt][:vault][:leases], mode: mode)
+        vault_ok = connected_clusters.any? || Legion::Settings[:crypt][:vault][:connected]
 
         return if leases.empty? && !dynamic_rmq_creds?
         return unless vault_ok
@@ -310,7 +287,7 @@ module Legion
         if connected_clusters.any?
           selected_cluster = selected_connected_cluster_name
           client = selected_cluster ? vault_client(selected_cluster) : nil
-        elsif settings.dig(:vault, :connected)
+        elsif Legion::Settings[:crypt][:vault][:connected]
           client = vault_client
         end
 
@@ -327,13 +304,25 @@ module Legion
             log.warn "LeaseManager: #{fetched}/#{defined} lease(s) initialized (#{defined - fetched} failed)"
           end
         end
-      rescue StandardError => e
+      rescue IOError, SystemCallError, Timeout::Error, Faraday::Error, Legion::Crypt::Vault::HTTPError => e
         handle_exception(e, level: :warn, operation: 'crypt.start_lease_manager')
       end
 
+      def postgresql_leases_for_mode(leases:, mode:)
+        role = POSTGRES_ROLE_MAP[mode]
+        return leases unless role
+
+        postgresql_key = leases.key?(:postgresql) ? :postgresql : 'postgresql'
+        definition = leases[postgresql_key]
+        return leases unless definition.is_a?(Hash)
+
+        path_key = definition.key?(:path) ? :path : 'path'
+        leases.merge(postgresql_key => definition.merge(path_key => "postgresql/creds/#{role}"))
+      end
+
       def start_token_renewers
         started = 0
-        configurations = clusters.empty? ? { nil => vault_settings } : clusters
+        configurations = clusters.empty? ? { nil => Legion::Settings[:crypt][:vault] } : clusters
         configurations.each do |name, config|
           next unless %w[kerberos ldap jwt].include?(config[:auth_method].to_s) && config[:connected]
 
@@ -364,19 +353,19 @@ module Legion
       end
 
       def start_svid_rotation
-        return unless Spiffe.enabled?
+        return unless Legion::Crypt::Spiffe.enabled?
 
         log.info 'Legion::Crypt starting SPIFFE SVID rotation'
-        @svid_rotation = Spiffe::SvidRotation.new
+        @svid_rotation = Legion::Crypt::Spiffe::SvidRotation.new
         @svid_rotation.start
-      rescue StandardError => e
+      rescue IOError, SystemCallError, Timeout::Error, Legion::Crypt::Spiffe::Error => e
         handle_exception(e, level: :warn, operation: 'crypt.start_svid_rotation')
       end
 
       def stop_svid_rotation(deadline: nil)
         return unless @svid_rotation
 
-        Legion::Crypt::VaultOperation.with_timeout(deadline: deadline) { @svid_rotation.stop }
+        Legion::Crypt::Vault::Operation.with_timeout(deadline: deadline) { @svid_rotation.stop }
       ensure
         @svid_rotation = nil
       end