azurekeyvault

package
v1.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 19, 2026 License: MIT Imports: 44 Imported by: 0

README

Azure Key Vault

Parity grade: B · SDK azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0 · last audited 2026-10-18 (d52fe4ac6)

Coverage

Metric Value
PARITY entries audited 14 (11 ok, 3 partial)
Feature families 5 (4 ok, 1 partial)
Known gaps 6
Deferred items 0
Resource leaks clean
Known gaps
  • PKCS#12: certificate import and a PFX backing secret need a PKCS#12 module (software.sslmate.com/src/go-pkcs12); backing secrets are PEM (application/x-pem-file) today even when the policy asks for application/x-pkcs12.
  • Certificate issuers other than Self (Unknown/CSR + MergeCertificate, DigiCert, GlobalSign) are not implemented; UPN subject alternative names are rejected.
  • Key release (ReleaseKey, release_policy), GetKeyAttestation and ES256K/P-256K are not implemented.
  • Automatic key rotation and certificate lifetime actions are stored, not executed.
  • ARM Microsoft.KeyVault: deletedVaults, checkNameAvailability and vault purge are not implemented; ARM vault metadata is not persisted.
  • Backups use an opaque gopherstack blob, not Azure's format.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 10004

DefaultPort is the fixed TCP port for the Key Vault data-plane listener.

View Source 
const DefaultVaultName = "default"

DefaultVaultName is the vault addressed when the request carries neither a vault host label nor a /vaults/<name> path prefix.

Variables

View Source 
var ErrNilAppContext = errors.New("azurekeyvault: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

View Source 
var ErrSnapshotNull = errors.New("azurekeyvault: snapshot contains null entry")

ErrSnapshotNull is returned when a snapshot contains a null entity.

Functions

func RandomBytes 

func RandomBytes(count int) (string, error)

RandomBytes returns count cryptographically random bytes, base64url encoded.

Types

type AdminDetails 

type AdminDetails struct {
	FirstName string `json:"first_name,omitempty"`
	LastName  string `json:"last_name,omitempty"`
	Email     string `json:"email_address,omitempty"`
	Phone     string `json:"phone,omitempty"`
}

AdminDetails is an issuer organisation administrator.

type Attributes 

type Attributes struct {
	Enabled         *bool  `json:"enabled,omitempty"`
	NBF             *int64 `json:"nbf,omitempty"`
	Exp             *int64 `json:"exp,omitempty"`
	Created         *int64 `json:"created,omitempty"`
	Updated         *int64 `json:"updated,omitempty"`
	RecoverableDays *int   `json:"recoverableDays,omitempty"`
	RecoveryLevel   string `json:"recoveryLevel,omitempty"`
}

Attributes is the common attributes object (epoch-second timestamps).

func (*Attributes) Created0 

func (a *Attributes) Created0(fallback int64) int64

Created0 returns the created timestamp or fallback.

type BackupResult 

type BackupResult struct {
	Value string `json:"value"`
}

BackupResult is the backup response; Value is an opaque blob.

type CertLifetimeAction 

type CertLifetimeAction struct {
	Action  LifetimeActionType `json:"action"`
	Trigger LifetimeTrigger    `json:"trigger"`
}

CertLifetimeAction pairs a trigger with an action.

type CertOperation 

type CertOperation struct {
	Issuer                *IssuerRef `json:"issuer,omitempty"`
	ID                    string     `json:"id,omitempty"`
	Status                string     `json:"status"`
	StatusDetails         string     `json:"status_details,omitempty"`
	Target                string     `json:"target,omitempty"`
	RequestID             string     `json:"request_id,omitempty"`
	CSR                   []byte     `json:"csr,omitempty"`
	CancellationRequested bool       `json:"cancellation_requested"`
}

CertOperation is the pending certificate operation.

type CertPolicy 

type CertPolicy struct {
	KeyProps        *KeyProps            `json:"key_props,omitempty"`
	SecretProps     *SecretProps         `json:"secret_props,omitempty"`
	X509Props       *X509Props           `json:"x509_props,omitempty"`
	Issuer          *IssuerRef           `json:"issuer,omitempty"`
	Attributes      *Attributes          `json:"attributes,omitempty"`
	ID              string               `json:"id,omitempty"`
	LifetimeActions []CertLifetimeAction `json:"lifetime_actions,omitempty"`
}

CertPolicy is a certificate policy.

type CertVersion 

type CertVersion struct {
	Tags  map[string]string `json:"tags,omitempty"`
	ID    string            `json:"id"`
	X5T   string            `json:"x5t"`
	Attrs Attributes        `json:"attrs"`
	Cer   []byte            `json:"cer"`
}

CertVersion is one stored version of a certificate.

func (*CertVersion) Attr 

func (c *CertVersion) Attr() *Attributes

Attr implements Versioned.

func (*CertVersion) VersionID 

func (c *CertVersion) VersionID() string

VersionID implements Versioned.

type CertWire 

type CertWire struct {
	Attributes         *Attributes       `json:"attributes,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	Policy             *CertPolicy       `json:"policy,omitempty"`
	DeletedDate        *int64            `json:"deletedDate,omitempty"`
	ScheduledPurgeDate *int64            `json:"scheduledPurgeDate,omitempty"`
	ID                 string            `json:"id"`
	KID                string            `json:"kid,omitempty"`
	SID                string            `json:"sid,omitempty"`
	X5T                string            `json:"x5t,omitempty"`
	RecoveryID         string            `json:"recoveryId,omitempty"`
	Cer                []byte            `json:"cer,omitempty"`
}

CertWire is the certificate bundle/item/deleted-bundle wire shape.

type Collection 

type Collection[P Versioned] map[string]*Entity[P]

Collection is a vault's name-keyed set of entities of one kind.

type ConfigProvider 

type ConfigProvider interface {
	GetAzureKeyVaultSettings() Settings
}

ConfigProvider extracts Key Vault configuration from the abstract AppContext Config.

type Contact 

type Contact struct {
	Email string `json:"email,omitempty"`
	Name  string `json:"name,omitempty"`
	Phone string `json:"phone,omitempty"`
}

Contact is a certificate contact.

type Contacts 

type Contacts struct {
	ID       string    `json:"id,omitempty"`
	Contacts []Contact `json:"contacts"`
}

Contacts is the vault's certificate contact list.

type CreateCertRequest 

type CreateCertRequest struct {
	Policy     *CertPolicy       `json:"policy"`
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
}

CreateCertRequest is the POST /certificates/{name}/create body.

type CreateKeyRequest 

type CreateKeyRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	Kty        string            `json:"kty"`
	Crv        string            `json:"crv"`
	KeyOps     []string          `json:"key_ops"`
	KeySize    int               `json:"key_size"`
}

CreateKeyRequest is the POST /keys/{name}/create body.

type DeletedInfo 

type DeletedInfo struct {
	DeletedDate        int64 `json:"deletedDate"`
	ScheduledPurgeDate int64 `json:"scheduledPurgeDate"`
}

DeletedInfo marks an entity as soft-deleted.

type Entity 

type Entity[P Versioned] struct {
	Deleted    *DeletedInfo    `json:"deleted,omitempty"`
	Rotation   *RotationPolicy `json:"rotation,omitempty"`
	CertPolicy *CertPolicy     `json:"certPolicy,omitempty"`
	CertOp     *CertOperation  `json:"certOp,omitempty"`
	Name       string          `json:"name"`
	Versions   []P             `json:"versions"`
}

Entity is a named, versioned object (secret, key or certificate).

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Settings Settings
	Port     int
	// contains filtered or unexported fields
}

Handler serves the Key Vault data plane on its own HTTPS listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend, settings Settings) *Handler

NewHandler creates a Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name for metrics.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the request path for metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the supported operation names.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler for Key Vault operations.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant since RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Key Vault runs on its own listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the listener.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the fixed port and serves HTTPS, failing fast if the port is taken.

type ImportCertRequest 

type ImportCertRequest struct {
	Policy     *CertPolicy       `json:"policy"`
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	Value      string            `json:"value"`
	Password   string            `json:"pwd"`
}

ImportCertRequest is the POST /certificates/{name}/import body.

type ImportKeyRequest 

type ImportKeyRequest struct {
	Key        *JWK              `json:"key"`
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
}

ImportKeyRequest is the PUT /keys/{name} body.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds every vault's state under one coarse lock.

func NewInMemoryBackend 

func NewInMemoryBackend(autoCreate bool) *InMemoryBackend

NewInMemoryBackend creates an empty backend. autoCreate makes vaults spring into existence on first data-plane write.

func (*InMemoryBackend) BackupCertificate 

func (b *InMemoryBackend) BackupCertificate(vaultName, name string) (BackupResult, error)

BackupCertificate serialises a certificate with its backing key and secret.

func (*InMemoryBackend) BackupKey 

func (b *InMemoryBackend) BackupKey(vaultName, name string) (BackupResult, error)

BackupKey serialises every version of a key.

func (*InMemoryBackend) BackupSecret 

func (b *InMemoryBackend) BackupSecret(vaultName, name string) (BackupResult, error)

BackupSecret serialises every version of a secret.

func (*InMemoryBackend) CreateCertificate 

func (b *InMemoryBackend) CreateCertificate(
	vaultName, base, name string,
	req *CreateCertRequest,
) (CertOperation, error)

CreateCertificate issues a self-signed certificate.

func (*InMemoryBackend) CreateKey 

func (b *InMemoryBackend) CreateKey(vaultName, base, name string, req *CreateKeyRequest) (KeyWire, error)

CreateKey creates a new key (or a new version of an existing one).

func (*InMemoryBackend) CreateVault 

func (b *InMemoryBackend) CreateVault(name string, opts VaultOptions)

CreateVault registers (or updates) a vault, as the ARM resource provider does.

func (*InMemoryBackend) DeleteCertificate 

func (b *InMemoryBackend) DeleteCertificate(vaultName, base, name string) (CertWire, error)

DeleteCertificate soft-deletes a certificate and its backing key/secret.

func (*InMemoryBackend) DeleteContacts 

func (b *InMemoryBackend) DeleteContacts(vaultName, base string) (Contacts, error)

DeleteContacts removes the vault's contacts, returning them.

func (*InMemoryBackend) DeleteIssuer 

func (b *InMemoryBackend) DeleteIssuer(vaultName, base, name string) (Issuer, error)

DeleteIssuer removes an issuer, returning it.

func (*InMemoryBackend) DeleteKey 

func (b *InMemoryBackend) DeleteKey(vaultName, base, name string) (KeyWire, error)

DeleteKey soft-deletes a key.

func (*InMemoryBackend) DeletePendingCertificate 

func (b *InMemoryBackend) DeletePendingCertificate(vaultName, base, name string) (CertOperation, error)

DeletePendingCertificate removes the pending operation record.

func (*InMemoryBackend) DeleteSecret 

func (b *InMemoryBackend) DeleteSecret(vaultName, base, name string) (SecretWire, error)

DeleteSecret soft-deletes a secret.

func (*InMemoryBackend) DeleteVault 

func (b *InMemoryBackend) DeleteVault(name string)

DeleteVault removes a vault and everything in it.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(vaultName, base, name, version string) (CertWire, error)

GetCertificate returns a certificate version (latest when version is empty).

func (*InMemoryBackend) GetCertificatePolicy 

func (b *InMemoryBackend) GetCertificatePolicy(vaultName, base, name string) (CertPolicy, error)

GetCertificatePolicy returns a certificate's policy.

func (*InMemoryBackend) GetContacts 

func (b *InMemoryBackend) GetContacts(vaultName, base string) (Contacts, error)

GetContacts returns the vault's contacts.

func (*InMemoryBackend) GetDeletedCertificate 

func (b *InMemoryBackend) GetDeletedCertificate(vaultName, base, name string) (CertWire, error)

GetDeletedCertificate returns a soft-deleted certificate.

func (*InMemoryBackend) GetDeletedKey 

func (b *InMemoryBackend) GetDeletedKey(vaultName, base, name string) (KeyWire, error)

GetDeletedKey returns a soft-deleted key.

func (*InMemoryBackend) GetDeletedSecret 

func (b *InMemoryBackend) GetDeletedSecret(vaultName, base, name string) (SecretWire, error)

GetDeletedSecret returns a soft-deleted secret.

func (*InMemoryBackend) GetIssuer 

func (b *InMemoryBackend) GetIssuer(vaultName, base, name string) (Issuer, error)

GetIssuer returns an issuer.

func (*InMemoryBackend) GetKey 

func (b *InMemoryBackend) GetKey(vaultName, base, name, version string) (KeyWire, error)

GetKey returns a key version (latest when version is empty).

func (*InMemoryBackend) GetPendingCertificate 

func (b *InMemoryBackend) GetPendingCertificate(vaultName, base, name string) (CertOperation, error)

GetPendingCertificate returns the certificate's pending operation.

func (*InMemoryBackend) GetRotationPolicy 

func (b *InMemoryBackend) GetRotationPolicy(vaultName, base, name string) (RotationPolicy, error)

GetRotationPolicy returns a key's rotation policy.

func (*InMemoryBackend) GetSecret 

func (b *InMemoryBackend) GetSecret(vaultName, base, name, version string) (SecretWire, error)

GetSecret returns a secret version (latest when version is empty).

func (*InMemoryBackend) ImportCertificate 

func (b *InMemoryBackend) ImportCertificate(vaultName, base, name string, req *ImportCertRequest) (CertWire, error)

ImportCertificate imports a PEM certificate with its private key.

func (*InMemoryBackend) ImportKey 

func (b *InMemoryBackend) ImportKey(vaultName, base, name string, req *ImportKeyRequest) (KeyWire, error)

ImportKey imports a caller-supplied private key.

func (*InMemoryBackend) KeyOperation 

func (b *InMemoryBackend) KeyOperation(
	vaultName, base, name, version, op string, req *KeyOperationRequest,
) (any, error)

KeyOperation runs one crypto operation against a key version.

func (*InMemoryBackend) ListCertificateVersions 

func (b *InMemoryBackend) ListCertificateVersions(vaultName, base, name string) ([]CertWire, error)

ListCertificateVersions lists every version of a certificate.

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(vaultName, base string, deleted bool) ([]CertWire, error)

ListCertificates lists certificates, deleted or active.

func (*InMemoryBackend) ListIssuers 

func (b *InMemoryBackend) ListIssuers(vaultName, base string) ([]IssuerItem, error)

ListIssuers lists issuers by name.

func (*InMemoryBackend) ListKeyVersions 

func (b *InMemoryBackend) ListKeyVersions(vaultName, base, name string) ([]KeyWire, error)

ListKeyVersions lists every version of a key.

func (*InMemoryBackend) ListKeys 

func (b *InMemoryBackend) ListKeys(vaultName, base string, deleted bool) ([]KeyWire, error)

ListKeys lists keys, deleted or active.

func (*InMemoryBackend) ListSecretVersions 

func (b *InMemoryBackend) ListSecretVersions(vaultName, base, name string) ([]SecretWire, error)

ListSecretVersions lists every version of a secret.

func (*InMemoryBackend) ListSecrets 

func (b *InMemoryBackend) ListSecrets(vaultName, base string, deleted bool) ([]SecretWire, error)

ListSecrets lists secrets (latest version identifiers), deleted or active.

func (*InMemoryBackend) ListVaults 

func (b *InMemoryBackend) ListVaults() []string

ListVaults returns the registered vault names in sorted order.

func (*InMemoryBackend) PurgeCertificate 

func (b *InMemoryBackend) PurgeCertificate(vaultName, name string) error

PurgeCertificate permanently removes a soft-deleted certificate.

func (*InMemoryBackend) PurgeKey 

func (b *InMemoryBackend) PurgeKey(vaultName, name string) error

PurgeKey permanently removes a soft-deleted key.

func (*InMemoryBackend) PurgeSecret 

func (b *InMemoryBackend) PurgeSecret(vaultName, name string) error

PurgeSecret permanently removes a soft-deleted secret.

func (*InMemoryBackend) RecoverCertificate 

func (b *InMemoryBackend) RecoverCertificate(vaultName, base, name string) (CertWire, error)

RecoverCertificate restores a soft-deleted certificate.

func (*InMemoryBackend) RecoverKey 

func (b *InMemoryBackend) RecoverKey(vaultName, base, name string) (KeyWire, error)

RecoverKey restores a soft-deleted key.

func (*InMemoryBackend) RecoverSecret 

func (b *InMemoryBackend) RecoverSecret(vaultName, base, name string) (SecretWire, error)

RecoverSecret restores a soft-deleted secret.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreCertificate 

func (b *InMemoryBackend) RestoreCertificate(vaultName, base, value string) (CertWire, error)

RestoreCertificate recreates a certificate from a backup blob.

func (*InMemoryBackend) RestoreKey 

func (b *InMemoryBackend) RestoreKey(vaultName, base, value string) (KeyWire, error)

RestoreKey recreates a key from a backup blob.

func (*InMemoryBackend) RestoreSecret 

func (b *InMemoryBackend) RestoreSecret(vaultName, base, value string) (SecretWire, error)

RestoreSecret recreates a secret from a backup blob.

func (*InMemoryBackend) RotateKey 

func (b *InMemoryBackend) RotateKey(vaultName, base, name string) (KeyWire, error)

RotateKey creates a new version with fresh key material.

func (*InMemoryBackend) SetContacts 

func (b *InMemoryBackend) SetContacts(vaultName, base string, in *Contacts) (Contacts, error)

SetContacts replaces the vault's contacts.

func (*InMemoryBackend) SetIssuer 

func (b *InMemoryBackend) SetIssuer(vaultName, base, name string, in *Issuer) (Issuer, error)

SetIssuer creates or replaces an issuer.

func (*InMemoryBackend) SetRotationPolicy 

func (b *InMemoryBackend) SetRotationPolicy(
	vaultName, base, name string, in *RotationPolicy,
) (RotationPolicy, error)

SetRotationPolicy replaces a key's rotation policy.

func (*InMemoryBackend) SetSecret 

func (b *InMemoryBackend) SetSecret(vaultName, base, name string, req *SetSecretRequest) (SecretWire, error)

SetSecret creates a new version of the named secret.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) UpdateCertificate 

func (b *InMemoryBackend) UpdateCertificate(
	vaultName, base, name, version string, req *UpdateCertRequest,
) (CertWire, error)

UpdateCertificate updates a certificate version's mutable properties.

func (*InMemoryBackend) UpdateCertificatePolicy 

func (b *InMemoryBackend) UpdateCertificatePolicy(
	vaultName, base, name string, in *CertPolicy,
) (CertPolicy, error)

UpdateCertificatePolicy replaces a certificate's policy (applies to the next version).

func (*InMemoryBackend) UpdateIssuer 

func (b *InMemoryBackend) UpdateIssuer(vaultName, base, name string, in *Issuer) (Issuer, error)

UpdateIssuer merges the supplied fields into an existing issuer.

func (*InMemoryBackend) UpdateKey 

func (b *InMemoryBackend) UpdateKey(vaultName, base, name, version string, req *UpdateKeyRequest) (KeyWire, error)

UpdateKey updates a key version's mutable properties.

func (*InMemoryBackend) UpdatePendingCertificate 

func (b *InMemoryBackend) UpdatePendingCertificate(
	vaultName, base, name string, req *UpdatePendingRequest,
) (CertOperation, error)

UpdatePendingCertificate records a cancellation request on the pending operation.

func (*InMemoryBackend) UpdateSecret 

func (b *InMemoryBackend) UpdateSecret(
	vaultName, base, name, version string, req *UpdateSecretRequest,
) (SecretWire, error)

UpdateSecret updates a secret version's mutable properties.

func (*InMemoryBackend) VaultExists 

func (b *InMemoryBackend) VaultExists(name string) bool

VaultExists reports whether the vault is registered.

type Issuer 

type Issuer struct {
	Credentials *IssuerCredentials `json:"credentials,omitempty"`
	OrgDetails  *OrgDetails        `json:"org_details,omitempty"`
	Attributes  *Attributes        `json:"attributes,omitempty"`
	ID          string             `json:"id,omitempty"`
	Provider    string             `json:"provider,omitempty"`
}

Issuer is a stored certificate issuer.

type IssuerCredentials 

type IssuerCredentials struct {
	AccountID string `json:"account_id,omitempty"`
	Password  string `json:"pwd,omitempty"`
}

IssuerCredentials are the issuer account credentials.

type IssuerItem 

type IssuerItem struct {
	ID       string `json:"id"`
	Provider string `json:"provider,omitempty"`
}

IssuerItem is a list entry.

type IssuerRef 

type IssuerRef struct {
	CertTransparency *bool  `json:"cert_transparency,omitempty"`
	Name             string `json:"name,omitempty"`
	CertType         string `json:"cty,omitempty"`
}

IssuerRef references a certificate issuer.

type JWK 

type JWK struct {
	KID    string   `json:"kid,omitempty"`
	Kty    string   `json:"kty,omitempty"`
	Crv    string   `json:"crv,omitempty"`
	N      string   `json:"n,omitempty"`
	E      string   `json:"e,omitempty"`
	D      string   `json:"d,omitempty"`
	P      string   `json:"p,omitempty"`
	Q      string   `json:"q,omitempty"`
	DP     string   `json:"dp,omitempty"`
	DQ     string   `json:"dq,omitempty"`
	QI     string   `json:"qi,omitempty"`
	X      string   `json:"x,omitempty"`
	Y      string   `json:"y,omitempty"`
	K      string   `json:"k,omitempty"`
	KeyOps []string `json:"key_ops,omitempty"`
}

JWK is the JSON web key wire/import shape.

type KeyOperationRequest 

type KeyOperationRequest struct {
	Alg    string `json:"alg"`
	Value  string `json:"value"`
	Digest string `json:"digest"`
	IV     string `json:"iv"`
	AAD    string `json:"aad"`
	Tag    string `json:"tag"`
}

KeyOperationRequest is the body shared by every key crypto operation.

type KeyOperationResult 

type KeyOperationResult struct {
	KID   string `json:"kid"`
	Value string `json:"value"`
	IV    string `json:"iv,omitempty"`
	Tag   string `json:"authenticationTag,omitempty"`
	AAD   string `json:"aad,omitempty"`
}

KeyOperationResult is the encrypt/decrypt/sign/wrap/unwrap response.

type KeyProps 

type KeyProps struct {
	Exportable *bool  `json:"exportable,omitempty"`
	ReuseKey   *bool  `json:"reuse_key,omitempty"`
	Kty        string `json:"kty,omitempty"`
	Crv        string `json:"crv,omitempty"`
	KeySize    int    `json:"key_size,omitempty"`
}

KeyProps are the certificate policy key properties.

type KeyVersion 

type KeyVersion struct {
	Tags    map[string]string `json:"tags,omitempty"`
	ID      string            `json:"id"`
	Kty     string            `json:"kty"`
	Crv     string            `json:"crv,omitempty"`
	Attrs   Attributes        `json:"attrs"`
	KeyOps  []string          `json:"keyOps"`
	Priv    []byte            `json:"priv"`
	KeySize int               `json:"keySize,omitempty"`
	Managed bool              `json:"managed,omitempty"`
}

KeyVersion is one stored version of a key.

func (*KeyVersion) Attr 

func (k *KeyVersion) Attr() *Attributes

Attr implements Versioned.

func (*KeyVersion) VersionID 

func (k *KeyVersion) VersionID() string

VersionID implements Versioned.

type KeyWire 

type KeyWire struct {
	Key                *JWK              `json:"key,omitempty"`
	Attributes         *Attributes       `json:"attributes,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	DeletedDate        *int64            `json:"deletedDate,omitempty"`
	ScheduledPurgeDate *int64            `json:"scheduledPurgeDate,omitempty"`
	KID                string            `json:"kid,omitempty"`
	RecoveryID         string            `json:"recoveryId,omitempty"`
	Managed            bool              `json:"managed,omitempty"`
}

KeyWire is the key bundle/item/deleted-bundle wire shape.

type LifetimeActionType 

type LifetimeActionType struct {
	ActionType string `json:"action_type"`
}

LifetimeActionType names a lifetime action.

type LifetimeTrigger 

type LifetimeTrigger struct {
	LifetimePercentage int `json:"lifetime_percentage,omitempty"`
	DaysBeforeExpiry   int `json:"days_before_expiry,omitempty"`
}

LifetimeTrigger is a certificate lifetime-action trigger.

type ListResponse 

type ListResponse[T any] struct {
	NextLink string `json:"nextLink,omitempty"`
	Value    []T    `json:"value"`
}

ListResponse is the paged list envelope.

type OrgDetails 

type OrgDetails struct {
	ID           string         `json:"id,omitempty"`
	AdminDetails []AdminDetails `json:"admin_details,omitempty"`
}

OrgDetails are the issuer organisation details.

type Provider 

type Provider struct{}

Provider implements service.Provider for Azure Key Vault. Like the other Azure services it never matches on the shared AWS router; the handler serves its own HTTPS listener from StartWorker.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Key Vault backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type RandomBytesRequest 

type RandomBytesRequest struct {
	Count int `json:"count"`
}

RandomBytesRequest is the POST /rng body.

type RandomBytesResult 

type RandomBytesResult struct {
	Value string `json:"value"`
}

RandomBytesResult is the POST /rng response.

type RestoreRequest 

type RestoreRequest struct {
	Value string `json:"value"`
}

RestoreRequest is the restore request body.

type RotationAction 

type RotationAction struct {
	Type string `json:"type"`
}

RotationAction is a rotation lifetime-action action.

type RotationAttributes 

type RotationAttributes struct {
	Created    *int64 `json:"created,omitempty"`
	Updated    *int64 `json:"updated,omitempty"`
	ExpiryTime string `json:"expiryTime,omitempty"`
}

RotationAttributes carries the policy's expiry time and timestamps.

type RotationLifetimeAction 

type RotationLifetimeAction struct {
	Trigger RotationTrigger `json:"trigger"`
	Action  RotationAction  `json:"action"`
}

RotationLifetimeAction pairs a trigger with an action.

type RotationPolicy 

type RotationPolicy struct {
	Attributes      RotationAttributes       `json:"attributes"`
	ID              string                   `json:"id,omitempty"`
	LifetimeActions []RotationLifetimeAction `json:"lifetimeActions"`
}

RotationPolicy is a key's rotation policy.

type RotationTrigger 

type RotationTrigger struct {
	TimeAfterCreate  string `json:"timeAfterCreate,omitempty"`
	TimeBeforeExpiry string `json:"timeBeforeExpiry,omitempty"`
}

RotationTrigger is a rotation lifetime-action trigger.

type SANs 

type SANs struct {
	Emails      []string `json:"emails,omitempty"`
	DNSNames    []string `json:"dns_names,omitempty"`
	UPNs        []string `json:"upns,omitempty"`
	URIs        []string `json:"uris,omitempty"`
	IPAddresses []string `json:"ipAddresses,omitempty"`
}

SANs are subject alternative names.

type SecretProps 

type SecretProps struct {
	ContentType string `json:"contentType,omitempty"`
}

SecretProps are the certificate policy secret properties.

type SecretVersion 

type SecretVersion struct {
	Tags        map[string]string `json:"tags,omitempty"`
	ID          string            `json:"id"`
	Value       string            `json:"value"`
	ContentType string            `json:"contentType,omitempty"`
	KID         string            `json:"kid,omitempty"`
	Attrs       Attributes        `json:"attrs"`
	Managed     bool              `json:"managed,omitempty"`
}

SecretVersion is one stored version of a secret.

func (*SecretVersion) Attr 

func (s *SecretVersion) Attr() *Attributes

Attr implements Versioned.

func (*SecretVersion) VersionID 

func (s *SecretVersion) VersionID() string

VersionID implements Versioned.

type SecretWire 

type SecretWire struct {
	Value              *string           `json:"value,omitempty"`
	Attributes         *Attributes       `json:"attributes,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	DeletedDate        *int64            `json:"deletedDate,omitempty"`
	ScheduledPurgeDate *int64            `json:"scheduledPurgeDate,omitempty"`
	ID                 string            `json:"id"`
	ContentType        string            `json:"contentType,omitempty"`
	KID                string            `json:"kid,omitempty"`
	RecoveryID         string            `json:"recoveryId,omitempty"`
	Managed            bool              `json:"managed,omitempty"`
}

SecretWire is the secret bundle/item/deleted-bundle wire shape.

type SetSecretRequest 

type SetSecretRequest struct {
	Value       *string           `json:"value"`
	Attributes  *Attributes       `json:"attributes"`
	Tags        map[string]string `json:"tags"`
	ContentType string            `json:"contentType"`
}

SetSecretRequest is the PUT /secrets/{name} body.

type Settings 

type Settings struct {
	TLSCertFile string `` //nolint:lll // config struct tags are intentionally verbose
	/* 249-byte string literal not displayed */
	TLSKeyFile string `` //nolint:lll // config struct tags are intentionally verbose
	/* 152-byte string literal not displayed */
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 265-byte string literal not displayed */
	ValidateTokens bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 265-byte string literal not displayed */
	AutoCreateVaults bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 264-byte string literal not displayed */
}

Settings holds Key Vault service configuration.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the default Settings.

type UpdateCertRequest 

type UpdateCertRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
}

UpdateCertRequest is the PATCH /certificates/{name}/{version} body.

type UpdateKeyRequest 

type UpdateKeyRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	KeyOps     []string          `json:"key_ops"`
}

UpdateKeyRequest is the PATCH /keys/{name}/{version} body.

type UpdatePendingRequest 

type UpdatePendingRequest struct {
	CancellationRequested bool `json:"cancellation_requested"`
}

UpdatePendingRequest is the PATCH /certificates/{name}/pending body.

type UpdateSecretRequest 

type UpdateSecretRequest struct {
	Attributes  *Attributes       `json:"attributes"`
	Tags        map[string]string `json:"tags"`
	ContentType *string           `json:"contentType"`
}

UpdateSecretRequest is the PATCH /secrets/{name}/{version} body.

type VaultOptions 

type VaultOptions struct {
	RetentionDays   int
	PurgeProtection bool
}

VaultOptions are the ARM-controlled vault properties.

type VerifyResult 

type VerifyResult struct {
	Value bool `json:"value"`
}

VerifyResult is the verify response.

type Versioned 

type Versioned interface {
	comparable
	VersionID() string
	Attr() *Attributes
}

Versioned is implemented by the per-kind version records.

type X509Props 

type X509Props struct {
	SANs           *SANs    `json:"sans,omitempty"`
	Subject        string   `json:"subject,omitempty"`
	EKUs           []string `json:"ekus,omitempty"`
	KeyUsage       []string `json:"key_usage,omitempty"`
	ValidityMonths int      `json:"validity_months,omitempty"`
}

X509Props are the certificate policy X.509 properties.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.