Documentation
¶
Overview ¶
Package cloudconn holds named cloud account connections (preview). It stores non-secret settings and a credential reference only, and probes health through a read-only provider interface. No provider here creates or changes cloud resources.
Index ¶
- Constants
- Variables
- type Config
- type Connection
- type Fake
- type Input
- type Provider
- type Registry
- type Rows
- type Service
- func (s *Service) Create(ctx context.Context, actor, name string, in Input) (Connection, error)
- func (s *Service) Delete(ctx context.Context, name string) error
- func (s *Service) Get(ctx context.Context, name string) (Connection, error)
- func (s *Service) List(ctx context.Context) ([]Connection, error)
- func (s *Service) Test(ctx context.Context, name string) (TestResult, error)
- func (s *Service) Update(ctx context.Context, name string, in Input) (Connection, error)
- type Target
- type TestResult
Constants ¶
const ( ProviderOracle = "oracle" ProviderAWS = "aws" ProviderAzure = "azure" ProviderGCP = "gcp" ProviderHetzner = "hetzner" ProviderDigitalOcean = "digitalocean" AuthOIDCFederation = "oidc_federation" AuthRoleAssumption = "role_assumption" AuthSecretRef = "secret_ref" AuthStatic = "static" )
Providers and auth methods accepted on a connection.
const ( ClassOK = "ok" ClassUnsupported = "unsupported" ClassConfigInvalid = "config_invalid" ClassCredentialUnresolved = "credential_unresolved" //nolint:gosec // class name, not a credential ClassAuthFailed = "auth_failed" ClassUnreachable = "unreachable" ClassUnknown = "unknown" )
Health classes. A check reports one of these and nothing from the provider's own output.
Variables ¶
var ( ErrInvalid = errors.New("cloudconn: invalid connection") ErrConflict = errors.New("cloudconn: connection name already in use") ErrNotFound = errors.New("cloudconn: connection not found") )
Errors the API maps to status codes.
var ErrUnsupported = errors.New("cloudconn: not implemented for this provider")
ErrUnsupported marks a provider operation this build does not implement.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Region string `json:"region,omitempty"`
AccountID string `json:"account_id,omitempty"` // AWS account, OCI tenancy OCID, GCP project
Compartment string `json:"compartment,omitempty"`
RoleARN string `json:"role_arn,omitempty"`
SubscriptionID string `json:"subscription_id,omitempty"`
ResourceGroup string `json:"resource_group,omitempty"`
OIDCAudience string `json:"oidc_audience,omitempty"`
}
Config holds the non-secret settings; which fields apply depends on the provider.
type Connection ¶
type Connection struct {
Name string
Provider string
TeamID string
AuthMethod string
Config Config
CredentialRef string
CreatedBy string
CreatedAt time.Time
UpdatedAt time.Time
LastCheckedAt time.Time
LastCheckClass string
}
Connection is one named cloud account. It never carries a credential value.
type Fake ¶
type Fake struct {
ProviderName string
Class string
Err error
Regions []string
Checked []string
CredLen []int
// contains filtered or unexported fields
}
Fake is an in-memory provider for tests: it validates like the real config rules and returns a scripted class, recording the credential length it was handed.
func (*Fake) ListRegions ¶
ListRegions returns the scripted regions.
type Input ¶
type Input struct {
Provider string
TeamID string
AuthMethod string
Config Config
CredentialRef string
}
Input creates or updates a connection. On update empty strings keep the stored value and a zero Config keeps the stored settings; Provider and Name never change.
type Provider ¶
type Provider interface {
Name() string
// ValidateConfig checks the non-secret settings for the given auth method.
ValidateConfig(cfg Config, authMethod string) error
// Check makes one read-only call and returns a Class constant; detail stays inside the provider.
Check(ctx context.Context, t Target) (string, error)
// ListRegions returns region identifiers the credential can see, read-only.
ListRegions(ctx context.Context, t Target) ([]string, error)
}
Provider is the read-only side of a cloud. Implementations must not create, change or delete anything in the account.
type Registry ¶
Registry maps a provider name to its implementation.
func DefaultRegistry ¶
func DefaultRegistry() Registry
DefaultRegistry registers every provider as not implemented. The real OCI, AWS and Azure clients need SDK dependencies this repo does not carry yet; adding them is an owner decision.
func FakeRegistry ¶
FakeRegistry maps every provider name to a Fake sharing one script.
type Rows ¶
type Rows interface {
ListCloudConnections(ctx context.Context) ([]store.CloudConnection, error)
GetCloudConnection(ctx context.Context, name string) (store.CloudConnection, error)
CreateCloudConnection(ctx context.Context, c store.CloudConnection) error
UpdateCloudConnection(ctx context.Context, c store.CloudConnection) error
SetCloudConnectionCheck(ctx context.Context, name, class string, at time.Time) error
DeleteCloudConnection(ctx context.Context, name string) error
}
Rows is the connection table.
type Service ¶
type Service struct {
Rows Rows
Providers Registry
// Sources resolves secret:// references for a probe; nil means references cannot be resolved.
Sources *secretsource.Resolver
Now func() time.Time
}
Service owns the connection set and runs read-only probes.
func (*Service) List ¶
func (s *Service) List(ctx context.Context) ([]Connection, error)
List returns every connection ordered by name.
type Target ¶
type Target struct {
Connection Connection
Credential secretsource.Value
}
Target is what a provider needs to probe one connection. Credential is zero for oidc_federation and masks itself when formatted.
type TestResult ¶
TestResult is the outcome of a health probe. Reason comes from a fixed table, never from provider output.
Source Files