gcpsecretmanager

package
v1.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 34 Imported by: 0

README

Google Secret Manager

Parity grade: B · SDK cloud.google.com/go/secretmanager@v1.22.0 · last audited 2026-10-18 (8d07d8213)

Coverage

Metric Value
PARITY entries audited 15 (15 ok)
Feature families 4 (2 ok, 2 partial)
Known gaps 4
Deferred items 0
Resource leaks clean
Known gaps
  • RotateSecret and EnableManagedRotation are not implemented (UNIMPLEMENTED); rotation settings are stored but no rotation messages are published to topics.
  • Regional (locations/) secrets are not served; only global projects//secrets/* resources.
  • Customer-managed encryption keys are stored and echoed in replication_status but never used or validated against Cloud KMS.
  • Secret tags and secret_type are stored but not validated.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 8086

DefaultPort is the dedicated gRPC listener's default TCP port.

Variables

View Source 
var ErrNilAppContext = errors.New("gcpsecretmanager: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type ConfigProvider 

type ConfigProvider interface {
	GetGCPSecretManagerSettings() Settings
}

ConfigProvider extracts Secret Manager configuration from the AppContext Config.

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Port int
	// contains filtered or unexported fields
}

Handler serves the Secret Manager gRPC API on a dedicated listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler; callers override Port from Settings.

func (*Handler) API 

func (h *Handler) API() secretmanagerpb.SecretManagerServiceServer

API exposes the SecretManagerService for in-process callers (dashboard proxy).

func (*Handler) Addr 

func (h *Handler) Addr() string

Addr returns the bound listener address, or "" before StartWorker.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(*echo.Context) string

ExtractOperation is unused: requests never reach the shared router.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(*echo.Context) string

ExtractResource is unused: requests never reach the shared router.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the supported gRPC methods.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns a 404 handler; the real API is gRPC on the dedicated port.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Secret Manager runs on its own gRPC listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the gRPC server and the janitor, forcing a close after a short grace period.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the dedicated listener synchronously so a port conflict is returned to the caller.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds all secrets, versions and IAM policies under one lock.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) AccessSecretVersion 

func (b *InMemoryBackend) AccessSecretVersion(name string) (*secretmanagerpb.AccessSecretVersionResponse, error)

AccessSecretVersion returns the payload of an ENABLED version.

func (*InMemoryBackend) AddSecretVersion 

func (b *InMemoryBackend) AddSecretVersion(
	req *secretmanagerpb.AddSecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

AddSecretVersion stores a new ENABLED version holding the payload.

func (*InMemoryBackend) CreateSecret 

func (b *InMemoryBackend) CreateSecret(req *secretmanagerpb.CreateSecretRequest) (*secretmanagerpb.Secret, error)

CreateSecret creates a secret under parent.

func (*InMemoryBackend) DeleteSecret 

func (b *InMemoryBackend) DeleteSecret(req *secretmanagerpb.DeleteSecretRequest) error

DeleteSecret removes a secret and all its versions; a non-empty etag must match.

func (*InMemoryBackend) DestroySecretVersion 

func (b *InMemoryBackend) DestroySecretVersion(
	req *secretmanagerpb.DestroySecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

DestroySecretVersion destroys a version now, or schedules it when the secret has version_destroy_ttl.

func (*InMemoryBackend) DisableSecretVersion 

func (b *InMemoryBackend) DisableSecretVersion(
	req *secretmanagerpb.DisableSecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

DisableSecretVersion moves an ENABLED version to DISABLED.

func (*InMemoryBackend) EnableSecretVersion 

func (b *InMemoryBackend) EnableSecretVersion(
	req *secretmanagerpb.EnableSecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

EnableSecretVersion moves a DISABLED version back to ENABLED, cancelling any scheduled destruction.

func (*InMemoryBackend) GetIamPolicy 

func (b *InMemoryBackend) GetIamPolicy(resource string) (*iampb.Policy, error)

GetIamPolicy returns a secret's IAM policy, or an empty policy when none is set.

func (*InMemoryBackend) GetSecret 

func (b *InMemoryBackend) GetSecret(name string) (*secretmanagerpb.Secret, error)

GetSecret returns a secret.

func (*InMemoryBackend) GetSecretVersion 

func (b *InMemoryBackend) GetSecretVersion(name string) (*secretmanagerpb.SecretVersion, error)

GetSecretVersion returns version metadata (no payload); name may use latest or an alias.

func (*InMemoryBackend) ListSecretVersions 

func (b *InMemoryBackend) ListSecretVersions(
	req *secretmanagerpb.ListSecretVersionsRequest,
) ([]*secretmanagerpb.SecretVersion, string, int, error)

ListSecretVersions returns a secret's versions newest first, and the total match count.

func (*InMemoryBackend) ListSecrets 

func (b *InMemoryBackend) ListSecrets(
	req *secretmanagerpb.ListSecretsRequest,
) ([]*secretmanagerpb.Secret, string, int, error)

ListSecrets returns the matching secrets of a project sorted by name, and the total match count.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot.

func (*InMemoryBackend) RunJanitor 

func (b *InMemoryBackend) RunJanitor(ctx context.Context, every time.Duration)

RunJanitor sweeps expired secrets and due version destructions until ctx ends.

func (*InMemoryBackend) SetIamPolicy 

func (b *InMemoryBackend) SetIamPolicy(req *iampb.SetIamPolicyRequest) (*iampb.Policy, error)

SetIamPolicy replaces a secret's IAM policy; a non-empty etag must match the stored policy.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises all secrets, versions (with payloads) and policies.

func (*InMemoryBackend) Sweep 

func (b *InMemoryBackend) Sweep()

Sweep deletes expired secrets and finalises version destructions that are due.

func (*InMemoryBackend) TestIamPermissions 

func (b *InMemoryBackend) TestIamPermissions(
	req *iampb.TestIamPermissionsRequest,
) (*iampb.TestIamPermissionsResponse, error)

TestIamPermissions reports every requested permission as granted: the emulator performs no authorization.

func (*InMemoryBackend) UpdateSecret 

func (b *InMemoryBackend) UpdateSecret(req *secretmanagerpb.UpdateSecretRequest) (*secretmanagerpb.Secret, error)

UpdateSecret applies the masked fields of req.Secret to the stored secret.

type Provider 

type Provider struct{}

Provider implements service.Provider for Google Secret Manager. It serves gRPC on its own listener (see Handler.StartWorker) and never matches on the shared AWS router.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler; the port is bound in StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type Settings 

type Settings struct {
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 180-byte string literal not displayed */
}

Settings holds service-level configuration, embedded in the root CLI command as CLI.GCPSecretManager.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider is available.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.