An engine is a mounted secret backend at a path. TigerTrust ships Vault-compatible engines — enable them per workspace, then use them via tt secrets or any Vault-compatible client.

​
Supported engines

TypePath conventionWhat it does
kv (v2)secret/Versioned static secrets
kv (v1)kv/Simple key-value
transittransit/Encrypt / decrypt as a service, key rotation
pkipki/Issue X.509 leaf certs
databasedatabase/Dynamic short-lived DB credentials
wrapping(implicit)Single-use response wrapping

​
Enable an engine

tt secrets engines enable kv secret
tt secrets engines enable transit
tt secrets engines enable pki
tt secrets engines enable database
Or via the Vault CLI: 
vault secrets enable -path=secret kv-v2
vault secrets enable transit

​
KV v2

tt secrets write secret/prod/db/password value=hunter2
tt secrets read  secret/prod/db/password
tt secrets read  secret/prod/db/password --version=1
tt secrets list  secret/prod/db

​
Transit

tt secrets write transit/keys/prod-payments type=aes256-gcm96
tt secrets write transit/encrypt/prod-payments plaintext=$(base64 <<< "card")
tt secrets write transit/decrypt/prod-payments ciphertext=vault:v1:...
tt secrets write transit/keys/prod-payments/rotate

​
PKI

tt secrets write pki/root/generate/internal \
  common_name="TigerTrust Internal Root" ttl=87600h

tt secrets write pki/roles/web-server \
  allowed_domains=example.com allow_subdomains=true max_ttl=90d

tt secrets write pki/issue/web-server common_name=web.example.com
The PKI engine can be chained to CLM’s PKI Core as its issuer.

​
Database

tt secrets write database/config/prod-postgres \
  plugin_name=postgresql-database-plugin \
  connection_url='postgres://root:...@db:5432/postgres' \
  allowed_roles=prod-postgres

tt secrets write database/roles/prod-postgres \
  db_name=prod-postgres \
  default_ttl=1h max_ttl=24h \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT read_only TO \"{{name}}\";"

tt secrets read database/creds/prod-postgres

Rotation

Automate KV and DB rotation on a schedule.

Policies

Restrict who can read/write which paths.