Documentation
¶
Overview ¶
Package secretprovider reads app secrets live from Doppler, Infisical or 1Password Connect, read only, as a sibling of internal/vault. A provider value is never persisted: it is read at container create time, kept only in a short in-memory cache, and registered with the output masker.
Index ¶
- Constants
- Variables
- func ParseIdentity(token string) (id, secret string, ok bool)
- func TunablesFrom(s *runtimesettings.Service) func(context.Context) Tunables
- type Config
- type EnvResolver
- type Ref
- type Resolver
- type SecretResolver
- type Secrets
- type Store
- func (s Store) Delete(ctx context.Context, name string) error
- func (s Store) Get(ctx context.Context, name string) (Config, bool, error)
- func (s Store) HasToken(ctx context.Context, name string) bool
- func (s Store) List(ctx context.Context) ([]Config, error)
- func (s Store) Put(ctx context.Context, cfg Config, token string, grace time.Duration, ...) (Config, error)
- func (s Store) ResolvesLive(ctx context.Context, v string) (bool, error)
- func (s Store) Tokens(ctx context.Context, cfg Config, now time.Time) (current, previous string, err error)
- type Tunables
Constants ¶
const ( TypeDoppler = "doppler" TypeInfisical = "infisical" TypeOnePassword = "onepassword" SchemeDoppler = "doppler://" SchemeInfisical = "infisical://" SchemeOnePass = "op://" )
Provider types and their reference schemes.
const IdentityPrefix = "infisical-identity:"
IdentityPrefix marks a stored Infisical credential as machine identity universal auth: "infisical-identity:<clientId>:<clientSecret>". Anything else is used as an access token.
const OwnerKey = "secretproviders"
OwnerKey is the internal/secrets namespace that holds every provider config and token.
Variables ¶
var ( ErrNotFound = errors.New("secret not found in provider") ErrBlockedAddress = errors.New("provider address is private or link-local and is not an admin set self-hosted URL") ErrRedirectBlocked = errors.New("provider redirected to another host or scheme") ErrUnavailable = errors.New("provider unavailable") )
Errors a caller may match to explain a failed read.
var ErrNoProvider = errors.New("secret provider is not configured on this control plane")
ErrNoProvider is returned when a reference names a provider that is not configured.
var ErrRateLimited = errors.New("provider read rate limit reached, try again shortly")
ErrRateLimited is returned when a provider is asked for more reads than the live limit allows.
Functions ¶
func ParseIdentity ¶
ParseIdentity splits a stored identity credential; ok is false when it is not one.
func TunablesFrom ¶
func TunablesFrom(s *runtimesettings.Service) func(context.Context) Tunables
TunablesFrom reads the read bounds from runtime settings; a nil service serves env then defaults.
Types ¶
type Config ¶
type Config struct {
Name string `json:"name"`
Type string `json:"type"`
Project string `json:"project"`
Environment string `json:"environment"`
Path string `json:"path,omitempty"`
BaseURL string `json:"base_url,omitempty"`
UpdatedAt time.Time `json:"updated_at"`
GraceUntil time.Time `json:"grace_until,omitempty"`
}
Config is one provider connection. The token is stored separately and never appears here.
type EnvResolver ¶
type EnvResolver struct {
Inner SecretResolver
Providers Store
Resolver *Resolver
Tunables func(context.Context) Tunables
}
EnvResolver wraps the app secret resolver so a stored doppler://, infisical:// or op:// provider value resolves live.
func (EnvResolver) Resolve ¶
Resolve returns the stored value, or the live provider value when it is a reference. Fails closed.
func (EnvResolver) ResolveRef ¶
ResolveRef reads one reference, retrying with the previous token inside its grace window.
type Ref ¶
type Ref struct {
Type string
Provider string
Name string
Path string
// Vault and Item are set for op:// references only. Name holds the field.
Vault string
Item string
}
Ref is a parsed provider reference held as an app secret value.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver performs provider reads with an SSRF-guarded HTTP client.
func Default ¶
func Default() *Resolver
Default returns the process-wide Resolver whose cache every caller shares.
type SecretResolver ¶
type SecretResolver interface {
Exists(ctx context.Context, serviceName, envKey string) (bool, error)
Resolve(ctx context.Context, serviceName, envKey string) (string, error)
}
SecretResolver is the reconciler's secret read surface.
type Secrets ¶
type Secrets interface {
SetValue(ctx context.Context, serviceName, envKey, plaintext string) error
Resolve(ctx context.Context, serviceName, envKey string) (string, error)
Exists(ctx context.Context, serviceName, envKey string) (bool, error)
ListKeys(ctx context.Context, serviceName string) ([]store.SecretKeyInfo, error)
DeleteValue(ctx context.Context, serviceName, envKey string) error
}
Secrets is the internal/secrets.Manager surface the provider store needs.
type Store ¶
type Store struct {
Secrets Secrets
}
Store keeps provider configs and tokens encrypted in internal/secrets.
func (Store) Delete ¶
Delete removes the config and both tokens; removing a missing provider is not an error.
func (Store) Put ¶
func (s Store) Put(ctx context.Context, cfg Config, token string, grace time.Duration, now time.Time) (Config, error)
Put saves cfg. An empty token keeps the stored one; a new token keeps the old one for grace.
func (Store) ResolvesLive ¶
ResolvesLive reports whether v would be read through a configured provider at container create. Native op:// values that name no 1Password provider stay literal, so they do not count.
Source Files