uBix Vault 1.1 — The First Enterprise-Parity Feature: Resource Quotas
Where 1.0 left off
At 1.0, uBix Vault matched the Community (free-tier) surface of HashiCorp Vault — barrier, Shamir seal, KV, transit, PKI, dynamic database credentials, identity, the full auth set — and froze the API under SemVer. The honest gap was always the Enterprise tier: the big, differentiated features. 1.1 is the first step across that line, and it starts with the one that’s most self-contained and most broadly useful: resource quotas.
What 1.1 adds
Two kinds of quota, both Vault-compatible, both managed over the HTTP API (sys/quotas/*) and gated by ACL:
- Rate-limit quotas — a per-client request-rate limit scoped to an API path prefix. The most specific matching quota wins, and a client over its limit gets a
429withRetry-After. There’s a global default (set viasys/quotas/config, and the old-rate-limitflag now feeds it) that applies even while the vault is sealed — so nobody can hammer the unseal endpoint — while path-scoped quotas take effect once it’s unsealed. - Lease-count quotas — a cap on the number of active leases (today, dynamic database credentials) under a path prefix. Hit the cap and the next credential request is refused before anything is issued, so a runaway client can’t exhaust the vault or the database behind it.
Both feed a ubixvault_quota_exceeded_total metric, so a wall being hit is visible, not inferred.
Why quotas first
Because they earn their place immediately and they don’t touch the crown jewels. A secrets manager with one global rate limit and no cap on lease growth has two real, boring failure modes — a noisy client degrading everyone, and leases piling up until something downstream falls over. Quotas close both. And the design — path-prefix scoping, an in-house token bucket, counting that lives with the thing being counted — is deliberately the pattern the next Enterprise features (namespaces, and per-namespace quotas) will build on, so getting it right now pays forward.
Built the way the hard features have to be
Like the SQL storage backend and the KMS seal before it, this went in design-note first, then an ADR, then small reviewed slices — rate-limit quotas, then the default/config, then lease-count — each one CI-green before the next. No new dependency; it’s the standard library and the token bucket the vault already had. The whole thing is additive and backward-compatible with the 1.0 API: if you don’t create a quota, nothing changes.
And the part that hasn’t changed
1.1 is a feature release, not an assurance one. uBix Vault still has not had an independent third-party security audit — that’s tracked separately and, as of 1.0, it explicitly does not gate the version number. The honest guidance is the same: weigh it before high-blast-radius secrets, run it alongside an audited store, make the risk visible. A version bump doesn’t move that bar; only an auditor does.
uBix Vault 1.1.0 is BSD 3-Clause, on GitHub at github.com/cwolsen7905/uBixVault, tagged v1.1.0, with signed multi-arch images. Next on the road to Enterprise parity: namespaces.