Documentation
¶
Overview ¶
Package vault resolves a live secret value from an external HashiCorp Vault instance at container-create time, as an alternative to internal/secrets' own envelope-encrypted storage. It is a sibling package, not a change to internal/secrets: a Vault-sourced value is never persisted here or anywhere else. It may be held in memory for a short runtime-setting TTL, the same discipline internal/secrets uses.
Index ¶
- Variables
- func AddressRule(host string) string
- func ResolveWithGrace(now, previousExpiresAt time.Time, current, previous string, attempt Attempt) (string, error)
- func TunablesFrom(s *runtimesettings.Service) func(context.Context) Tunables
- type Attempt
- type Resolver
- func (r *Resolver) Flush()
- func (r *Resolver) Probe(ctx context.Context, cfg store.VaultSettings, credential string) error
- func (r *Resolver) ProbePath(ctx context.Context, cfg store.VaultSettings, credential, path string) error
- func (r *Resolver) Resolve(ctx context.Context, cfg store.VaultSettings, credential, path, key string) (string, error)
- type Tunables
Constants ¶
This section is empty.
Variables ¶
var ( ErrBlockedAddress = errors.New("vault address is link-local, metadata or private; for a Vault on a private or loopback address turn on the vault.allow_private_address setting") ErrRedirectBlocked = errors.New("vault redirected to another host or scheme") )
Errors returned when the configured address fails the connection guard.
var ErrPathDenied = errors.New("vault: policy does not allow reading the path")
ErrPathDenied marks a path the credential's policy does not allow reading.
var ErrSecretMissing = errors.New("vault: secret not found")
ErrSecretMissing marks a secret, field or version that does not exist, so callers can tell it from an outage.
Functions ¶
func AddressRule ¶
AddressRule reports the always-blocked rule a literal host hits, "" when the host passes. Names are only checked against metadata hosts: the dial-time guard still covers whatever a name resolves to.
func ResolveWithGrace ¶
func ResolveWithGrace(now, previousExpiresAt time.Time, current, previous string, attempt Attempt) (string, error)
ResolveWithGrace tries the current credential first. The previous credential is tried only while previousExpiresAt is set and still in the future, so a rotation grace of 0 (no previous kept, zero expiry) never falls back.
func TunablesFrom ¶
func TunablesFrom(s *runtimesettings.Service) func(context.Context) Tunables
TunablesFrom reads the bounds from runtime settings; a nil service serves env then defaults.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver reads secrets from a HashiCorp Vault or OpenBao KV v2 engine. It keeps an AppRole login token and a short read cache in memory only.
func NewResolver ¶
func NewResolver() *Resolver
NewResolver returns a Resolver reading its bounds from runtime defaults and env.
func NewResolverWith ¶
NewResolverWith returns a Resolver reading its bounds from tunables on every resolve.
func (*Resolver) Flush ¶
func (r *Resolver) Flush()
Flush drops every cached token and value, for a connection change or rotation.
func (*Resolver) Probe ¶
Probe checks that the address is reachable and the credential authenticates, by looking up the caller's own token. It reads no secret and returns no data.
func (*Resolver) ProbePath ¶
func (r *Resolver) ProbePath(ctx context.Context, cfg store.VaultSettings, credential, path string) error
ProbePath is Probe plus a read-only check of one KV v2 path: the policy's capabilities on it, then its metadata. It never reads secret data.
func (*Resolver) Resolve ¶
func (r *Resolver) Resolve(ctx context.Context, cfg store.VaultSettings, credential, path, key string) (string, error)
Resolve authenticates against cfg's Vault instance using credential (a Vault token when cfg.AuthMethod is store.VaultAuthMethodToken, an AppRole secret ID when it's store.VaultAuthMethodAppRole), reads the KV v2 secret at path under cfg.MountPath, and returns the string value stored at key inside it. Never logs credential, path contents, or the returned value. A login failure fails the read; nothing stale is served.
Source Files