Documentation
¶
Overview ¶
Package vault resolves a live secret value from an external HashiCorp Vault instance at container-create time, as an alternative to internal/secrets' own envelope-encrypted storage. It is a sibling package, not a change to internal/secrets: a Vault-sourced value is never persisted here or anywhere else, only read fresh on every resolve and handed straight to the caller, the same discipline internal/secrets.Manager.Resolve already holds.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Resolver ¶
type Resolver struct{}
Resolver reads secrets from a HashiCorp Vault KV v2 engine. The zero value is ready to use: it holds no state between calls, so a fresh vaultapi.Client is authenticated on every Resolve.
func (*Resolver) Resolve ¶
func (r *Resolver) Resolve(ctx context.Context, cfg store.VaultSettings, credential, path, key string) (string, error)
Resolve authenticates against cfg's Vault instance using credential (a Vault token when cfg.AuthMethod is store.VaultAuthMethodToken, an AppRole secret ID when it's store.VaultAuthMethodAppRole), reads the KV v2 secret at path under cfg.MountPath, and returns the string value stored at key inside it. Never logs credential, path contents, or the returned value.
Source Files