Documentation
¶
Overview ¶
Package scaleway is the client of the Scaleway API the key rotation job uses (ADR 0007): it creates and deletes the API keys of a closed list of IAM applications, writes them to Secret Manager and to the secrets of a Serverless Container.
Every request goes to api.scaleway.com through the platform HTTP client, with the key of the rotator. No error, log line or request description of this package quotes a secret key.
Index ¶
- Constants
- Variables
- func NewClient(opts Options) (*scw.Client, error)
- type ContainerSecrets
- type ContainerSecretsOptions
- type Credentials
- func (c *Credentials) CreateCredential(ctx context.Context, application string, expiresAt time.Time) (app.Credential, error)
- func (c *Credentials) DeleteCredential(ctx context.Context, application, accessKey string) error
- func (c *Credentials) ListCredentials(ctx context.Context, application string) ([]app.Credential, error)
- type Doer
- type Options
- type SecretPair
Constants ¶
const Host = "api.scaleway.com"
Host is the host of the Scaleway API, the only one the client of the rotator may reach (ADR 0007).
Variables ¶
var ErrApplicationNotAllowed = errors.New("application not in the list of the rotator")
ErrApplicationNotAllowed means a key of an application out of the closed list of the rotator was asked for, or met. Nothing was changed.
var ErrInvalidOptions = errors.New("invalid Scaleway client options")
ErrInvalidOptions means NewClient was given Options it cannot use. Its errors never quote a key.
Functions ¶
func NewClient ¶
NewClient returns a Scaleway client of opts. It reads no environment variable nor configuration file: every setting comes from opts. The request dumper the SDK turns on with SCW_DEBUG wraps a bare *http.Client only (scw/client.go, setRequestLogging), never opts.HTTP, so no request nor answer, a new secret key included, reaches a log.
Types ¶
type ContainerSecrets ¶
type ContainerSecrets struct {
// contains filtered or unexported fields
}
ContainerSecrets sets a key in two secret environment variables of a Serverless Container. It implements app.CredentialInstaller.
func NewContainerSecrets ¶
func NewContainerSecrets(client *scw.Client, opts ContainerSecretsOptions) (*ContainerSecrets, error)
NewContainerSecrets returns a ContainerSecrets of opts, through client, or ErrInvalidOptions.
func (*ContainerSecrets) InstallCredential ¶
func (s *ContainerSecrets) InstallCredential(ctx context.Context, c app.Credential) error
InstallCredential sets c in the two variables and waits until the container, redeployed with them, is ready. It goes through the containers/v1beta1 API, which keeps the secrets it is not given; the traffic moves to the new version once it is ready (ADR 0007).
type ContainerSecretsOptions ¶
type ContainerSecretsOptions struct {
// ContainerID is the Serverless Container whose secrets change.
ContainerID string
// AccessVar and SecretVar are its secret environment variables that
// hold the access key and the secret key.
AccessVar, SecretVar string
// Timeout bounds the wait for the container to be ready again, 10
// minutes when zero; Interval is the pause between two reads of its
// status, 5 seconds when zero.
Timeout, Interval time.Duration
}
ContainerSecretsOptions configures a ContainerSecrets.
type Credentials ¶
type Credentials struct {
// contains filtered or unexported fields
}
Credentials creates, lists and deletes the API keys of a closed list of IAM applications. It implements app.CredentialIssuer.
func NewCredentials ¶
func NewCredentials(client *scw.Client, projectID string, allowed []string) *Credentials
NewCredentials returns Credentials through client, for the applications allowed only; a new key gets projectID as its default project.
func (*Credentials) CreateCredential ¶
func (c *Credentials) CreateCredential(ctx context.Context, application string, expiresAt time.Time) (app.Credential, error)
CreateCredential creates a key of application valid until expiresAt.
func (*Credentials) DeleteCredential ¶
func (c *Credentials) DeleteCredential(ctx context.Context, application, accessKey string) error
DeleteCredential deletes the key accessKey once it has checked that it is a key of application.
func (*Credentials) ListCredentials ¶
func (c *Credentials) ListCredentials(ctx context.Context, application string) ([]app.Credential, error)
ListCredentials returns the keys of application.
type Doer ¶
Doer sends a request: the platform client, which allows Host only and bounds time and response size.
type Options ¶
type Options struct {
// HTTP sends the requests. Required.
HTTP Doer
// APIURL is the base URL of the API; "https://" + Host when empty.
APIURL string
// AccessKey and SecretKey are the key of the rotator. Required.
AccessKey string
SecretKey config.Secret
}
Options configures the Scaleway client.
type SecretPair ¶
type SecretPair struct {
// contains filtered or unexported fields
}
SecretPair keeps a key in two secrets of Secret Manager, one per half, as a Serverless Job reads them: one secret per environment variable. It implements app.CredentialInstaller.
func NewSecretPair ¶
func NewSecretPair(client *scw.Client, accessSecretID, secretSecretID string) *SecretPair
NewSecretPair returns a SecretPair writing the access key to the secret accessSecretID and the secret key to secretSecretID, through client.
func (*SecretPair) InstallCredential ¶
func (p *SecretPair) InstallCredential(ctx context.Context, c app.Credential) error
InstallCredential writes each half of c as a new version of its secret and disables the previous version, so the next run of the job reads c.
Source Files