credproviderpb

type CredentialProviderClient ¶

type CredentialProviderClient interface {
	// FetchSecret resolves a credential URI to its secret material, subject to
	// whatever authorization the provider applies to the request context.
	FetchSecret(ctx context.Context, in *FetchSecretRequest, opts ...grpc.CallOption) (*FetchSecretResponse, error)
}

CredentialProviderClient is the client API for CredentialProvider service.

For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.

CredentialProvider is the plugin API a secret backend implements so Substrate infrastructure (e.g. the egress gateway's credential injector) can fetch an external credential without Substrate storing it. A provider interprets the attested request context however is relevant to the store it fronts.

func NewCredentialProviderClient(cc grpc.ClientConnInterface) CredentialProviderClient

type CredentialProviderServer ¶

type CredentialProviderServer interface {
	// FetchSecret resolves a credential URI to its secret material, subject to
	// whatever authorization the provider applies to the request context.
	FetchSecret(context.Context, *FetchSecretRequest) (*FetchSecretResponse, error)
	// contains filtered or unexported methods
}

CredentialProviderServer is the server API for CredentialProvider service. All implementations must embed UnimplementedCredentialProviderServer for forward compatibility.

CredentialProvider is the plugin API a secret backend implements so Substrate infrastructure (e.g. the egress gateway's credential injector) can fetch an external credential without Substrate storing it. A provider interprets the attested request context however is relevant to the store it fronts.

type FetchSecretRequest ¶

type FetchSecretRequest struct {

	// The uri for the substrate secret to fetch.
	// Example: ate-secret://<provider name>/<provider tail>
	// The provider tail is provider-interpreted.
	Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
	// The SPIFFE ID of the actor on whose behalf the secret is fetched, as
	// verified by the egress gateway. This field always contains a SPIFFE ID.
	ActorSpiffeId string `protobuf:"bytes,2,opt,name=actor_spiffe_id,json=actorSpiffeId,proto3" json:"actor_spiffe_id,omitempty"`
	// contains filtered or unexported fields
}

FetchSecretRequest asks a provider to resolve one credential URI.

func (*FetchSecretRequest) Descriptor() ([]byte, []int)

func (x *FetchSecretRequest) GetActorSpiffeId() string

func (x *FetchSecretRequest) GetUri() string

func (*FetchSecretRequest) ProtoMessage()

func (x *FetchSecretRequest) ProtoReflect() protoreflect.Message

func (x *FetchSecretRequest) Reset()

func (x *FetchSecretRequest) String() string

type FetchSecretResponse ¶

type FetchSecretResponse struct {

	// The raw bytes contains the secret.
	OpaqueBytes []byte `protobuf:"bytes,1,opt,name=opaque_bytes,json=opaqueBytes,proto3" json:"opaque_bytes,omitempty"`
	// contains filtered or unexported fields
}

FetchSecretResponse carries the resolved credential.

func (*FetchSecretResponse) Descriptor() ([]byte, []int)

func (x *FetchSecretResponse) GetOpaqueBytes() []byte

func (*FetchSecretResponse) ProtoMessage()

func (x *FetchSecretResponse) ProtoReflect() protoreflect.Message

func (x *FetchSecretResponse) Reset()

func (x *FetchSecretResponse) String() string

type UnimplementedCredentialProviderServer ¶

type UnimplementedCredentialProviderServer struct{}

UnimplementedCredentialProviderServer must be embedded to have forward compatible implementations.

NOTE: this should be embedded by value instead of pointer to avoid a nil pointer dereference when methods are called.

func (UnimplementedCredentialProviderServer) FetchSecret(context.Context, *FetchSecretRequest) (*FetchSecretResponse, error)

type UnsafeCredentialProviderServer ¶

type UnsafeCredentialProviderServer interface {
	// contains filtered or unexported methods
}

UnsafeCredentialProviderServer may be embedded to opt out of forward compatibility for this service. Use of this interface is not recommended, as added methods to CredentialProviderServer will result in compilation errors.