Documentation
¶
Overview ¶
Package bao implements the reference Secret Broker backed by OpenBao (ADR-012). Secrets live in KV v2 under
<mount>/fenced/<tenant>/<tool>/<resource>
and are read on demand per invocation scope; issued handles are cached for a bounded TTL so the gateway does not hammer the broker on every tool call. The secret never leaves the gateway process: the handle is injected into the executing adapter only, and the gateway redacts it from results.
Index ¶
- Constants
- Variables
- type Broker
- type DynamicBroker
- func (b *DynamicBroker) Close(ctx context.Context) error
- func (b *DynamicBroker) Issue(ctx context.Context, scope tool.SecretScope) (tool.SecretHandle, error)
- func (b *DynamicBroker) Janitor(ctx context.Context) error
- func (b *DynamicBroker) OutstandingLeases() int
- func (b *DynamicBroker) Renew(ctx context.Context, leaseID string) (time.Duration, error)
- type DynamicCredentials
- type Option
Constants ¶
const DefaultMount = "secret"
DefaultMount is the KV v2 mount the broker reads.
Variables ¶
var ( // ErrSecretNotFound reports a scope that has no secret material in the // broker. The gateway fails the invocation closed. ErrSecretNotFound = errors.New("openbao secret not found for scope") // the read; the invocation fails closed rather than running without a // scoped credential. ErrSecretUnavailable = errors.New("openbao secret broker unavailable") )
Functions ¶
This section is empty.
Types ¶
type Broker ¶
type Broker struct {
// contains filtered or unexported fields
}
Broker issues scope-limited secret handles from OpenBao KV v2.
func (*Broker) Issue ¶
func (b *Broker) Issue(ctx context.Context, scope tool.SecretScope) (tool.SecretHandle, error)
Issue returns the secret material bound to the invocation scope, caching it for the bounded TTL. Fail-closed: any broker error fails the scope.
type DynamicBroker ¶
type DynamicBroker struct {
// contains filtered or unexported fields
}
DynamicBroker is the reference Secret Broker over the OpenBao database secrets engine (ADR-015): every issuance is a dynamic credential with a lease, renewed while the gateway needs it and revoked on Close or expiry — the credential can never outlive the gateway process.
func NewDynamicBroker ¶
func NewDynamicBroker(addr, token, role string, options ...Option) (*DynamicBroker, error)
NewDynamicBroker connects the broker to the database secrets engine role database/creds/<role>.
func (*DynamicBroker) Close ¶
func (b *DynamicBroker) Close(ctx context.Context) error
Close revokes every outstanding lease: dynamic credentials never outlive the gateway process.
func (*DynamicBroker) Issue ¶
func (b *DynamicBroker) Issue(ctx context.Context, scope tool.SecretScope) (tool.SecretHandle, error)
Issue returns dynamic credentials for the invocation scope, cached for the bounded TTL. Each fresh issuance registers a lease that the janitor renews and Close revokes.
func (*DynamicBroker) Janitor ¶
func (b *DynamicBroker) Janitor(ctx context.Context) error
Janitor renews leases approaching expiry and revokes leases that can no longer be renewed, so credentials never outlive their usefulness.
func (*DynamicBroker) OutstandingLeases ¶
func (b *DynamicBroker) OutstandingLeases() int
OutstandingLeases reports the number of tracked leases (tests and health).
type DynamicCredentials ¶
type DynamicCredentials struct {
Username string `json:"username"`
Password string `json:"password"`
}
DynamicCredentials are the username/password material issued by the OpenBao database secrets engine. The handle the gateway injects into the executing adapter is the JSON rendering of this struct.
type Option ¶
type Option func(*sharedOptions)
Option configures a broker.
func WithCacheTTL ¶
WithCacheTTL bounds how long an issued handle is reused for the same scope (default 30 seconds). Zero disables caching.
func WithHTTPClient ¶
WithHTTPClient injects the HTTP client (tests and custom transport).
func WithNamespace ¶
WithNamespace sets the OpenBao namespace header (enterprise namespaces / OpenBao namespaces when enabled).
Source Files