Documentation
¶
Overview ¶
Package secrets resolves secret references from multiple backends so a profile's [[env]] entries can pull values from more than literals and files.
A reference is a URI whose scheme selects the backend:
env://NAME read from the operator's environment vault://<mount>/<path>#<field> read a HashiCorp Vault KV v2 field aws://<secretId>[#<jsonKey>] read an AWS Secrets Manager secret gcp://<name>[#<version>] read a GCP Secret Manager secret version op://vault/item/field 1Password (not built in; errors)
The dispatcher returned by Default routes a reference by scheme. It is fail-closed: an unknown scheme, a missing value, or a backend error is returned as an error rather than resolving to an empty string, so a sandbox never starts believing it holds a credential it does not.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AWSResolver ¶
type AWSResolver struct {
// Region selects the regional Secrets Manager endpoint, e.g. us-east-1.
Region string
// AccessKeyID and SecretAccessKey are the SigV4 credentials.
AccessKeyID string
SecretAccessKey string
// SessionToken, when set, is sent as X-Amz-Security-Token for temporary
// (STS) credentials.
SessionToken string
// Endpoint overrides the derived https://secretsmanager.<region>.amazonaws.com/
// base URL; used by tests to point at an httptest.Server.
Endpoint string
// Client is the HTTP client used for the call; nil selects a client with a
// short default timeout.
Client *http.Client
}
AWSResolver reads secrets from AWS Secrets Manager over its JSON API, authenticating requests with AWS Signature Version 4 implemented here from the standard library (crypto/hmac + crypto/sha256), so no SDK is required.
A reference has the form:
aws://<secretId> return the raw SecretString aws://<secretId>#<jsonKey> parse SecretString as JSON and return <jsonKey>
where <secretId> is a secret name or ARN. ARNs contain ':' and '/', so the whole locator up to an optional '#' is treated verbatim as the SecretId.
func AWSResolverFromEnv ¶
func AWSResolverFromEnv() AWSResolver
AWSResolverFromEnv constructs an AWSResolver from the standard AWS environment variables. Missing values surface as errors at Resolve time (fail-closed), not at construction, so Default() never fails just because AWS is unused.
type Dispatcher ¶
Dispatcher routes a reference to a backend Resolver by its URI scheme.
type EnvResolver ¶
type EnvResolver struct{}
EnvResolver resolves env://NAME references from the operator's process environment. It is fail-closed: an unset or empty variable is an error.
type GCPResolver ¶
type GCPResolver struct {
// Project is the default GCP project for shorthand references; taken from
// GOOGLE_CLOUD_PROJECT when constructed via GCPResolverFromEnv.
Project string
// Endpoint overrides the https://secretmanager.googleapis.com base URL;
// used by tests to point at an httptest.Server.
Endpoint string
// Token is a bearer access token; when empty, GOOGLE_OAUTH_ACCESS_TOKEN and
// then the metadata server are tried.
Token string
// MetadataBase overrides the GCE metadata server base URL; used by tests.
MetadataBase string
// Client is the HTTP client used for calls; nil selects a client with a
// short default timeout.
Client *http.Client
}
GCPResolver reads secrets from Google Secret Manager over its REST API. A reference has either the fully-qualified form:
gcp://projects/<proj>/secrets/<name>/versions/<ver>
or the shorthand, which fills in the project from GOOGLE_CLOUD_PROJECT and defaults the version to "latest":
gcp://<name> projects/<proj>/secrets/<name>/versions/latest gcp://<name>#<version> projects/<proj>/secrets/<name>/versions/<version>
Authorization uses an OAuth2 access token (r.Token, else GOOGLE_OAUTH_ACCESS_TOKEN, else the GCE metadata server). Service-account JWT signing is intentionally out of scope.
func GCPResolverFromEnv ¶
func GCPResolverFromEnv() GCPResolver
GCPResolverFromEnv constructs a GCPResolver from GOOGLE_CLOUD_PROJECT and GOOGLE_OAUTH_ACCESS_TOKEN. Missing values surface as errors at Resolve time (fail-closed), not at construction, so Default() never fails just because GCP is unused.
type Resolver ¶
type Resolver interface {
// Resolve returns the secret value named by ref, or an error if the
// reference is malformed, the backend is unreachable, or the value is
// unset. Implementations must not return an empty string with a nil error.
Resolve(ctx context.Context, ref string) (string, error)
}
Resolver turns a scheme-qualified secret reference into its literal value.
func Default ¶
func Default() Resolver
Default returns the standard dispatcher, wiring each backend resolver from the process environment (Vault: VAULT_ADDR / VAULT_TOKEN; AWS: AWS_REGION / AWS_ACCESS_KEY_ID / …; GCP: GOOGLE_CLOUD_PROJECT / GOOGLE_OAUTH_ACCESS_TOKEN). Callers pass a reference to Resolve, e.g. secrets.Default().Resolve(ctx, "vault://kv/data/db#password").
type VaultResolver ¶
type VaultResolver struct {
// Addr is the Vault base URL, e.g. https://vault:8200 (no trailing /v1).
Addr string
// Token authenticates the read; sent as the X-Vault-Token header.
Token string
// Client is the HTTP client used for the read; nil selects a client with a
// short default timeout.
Client *http.Client
}
VaultResolver reads secrets from a HashiCorp Vault KV v2 mount over its HTTP API. A reference has the form:
vault://<mount>/<path>#<field>
e.g. vault://kv/database/prod#password reads field "password" from the logical path "database/prod" on the "kv" mount, issuing:
GET ${Addr}/v1/<mount>/data/<path> (X-Vault-Token: <Token>)
and returning .data.data.<field> from the JSON response.
func VaultResolverFromEnv ¶
func VaultResolverFromEnv() VaultResolver
VaultResolverFromEnv constructs a VaultResolver from VAULT_ADDR and VAULT_TOKEN. Missing values surface as errors at Resolve time (fail-closed), not at construction, so Default() never fails just because Vault is unused.
Source Files