Help us shape the future of Go! Take the 2026 Go Developer Survey

gcpsecretmanager

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 39 Imported by: 0

README

Google Secret Manager

Parity grade: B · SDK cloud.google.com/go/secretmanager@v1.22.0 · last audited 2026-10-18 (8d07d8213)

Coverage

Metric Value
PARITY entries audited 18 (18 ok)
Feature families 5 (3 ok, 2 partial)
Known gaps 5
Deferred items 0
Resource leaks clean
Known gaps
  • SECRET_ROTATE delivery is a single best-effort publish per due time (no 7-day retry), failures are dropped; a one-shot rotation clears next_rotation_time (inferred, not documented); TOPIC_CONFIGURED and other event types are not sent.
  • Managed rotation generates and stores the password version only; no Cloud SQL instance password is changed.
  • Regional secrets share the one listener; the secretmanager..rep.googleapis.com authority is honoured only for the location check, and location names are not validated against a region list.
  • Customer-managed encryption keys are stored and echoed in replication_status but never used or validated against Cloud KMS.
  • Secret tags and secret_type are stored but not validated.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 8086

DefaultPort is the dedicated gRPC listener's default TCP port.

Variables

View Source 
var ErrNilAppContext = errors.New("gcpsecretmanager: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type ConfigProvider 

type ConfigProvider interface {
	GetGCPSecretManagerSettings() Settings
}

ConfigProvider extracts Secret Manager configuration from the AppContext Config.

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Port int
	// contains filtered or unexported fields
}

Handler serves the Secret Manager gRPC API on a dedicated listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler; callers override Port from Settings.

func (*Handler) API 

func (h *Handler) API() secretmanagerpb.SecretManagerServiceServer

API exposes the SecretManagerService for in-process callers (dashboard proxy).

func (*Handler) Addr 

func (h *Handler) Addr() string

Addr returns the bound listener address, or "" before StartWorker.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(*echo.Context) string

ExtractOperation is unused: requests never reach the shared router.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(*echo.Context) string

ExtractResource is unused: requests never reach the shared router.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the supported gRPC methods.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns a 404 handler; the real API is gRPC on the dedicated port.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Secret Manager runs on its own gRPC listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the gRPC server and the janitor, forcing a close after a short grace period.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the dedicated listener synchronously so a port conflict is returned to the caller.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds all secrets, versions and IAM policies under one lock.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) AccessSecretVersion 

func (b *InMemoryBackend) AccessSecretVersion(name string) (*secretmanagerpb.AccessSecretVersionResponse, error)

AccessSecretVersion returns the payload of an ENABLED version.

func (*InMemoryBackend) AddSecretVersion 

func (b *InMemoryBackend) AddSecretVersion(
	req *secretmanagerpb.AddSecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

AddSecretVersion stores a new ENABLED version holding the payload.

func (*InMemoryBackend) CreateSecret 

func (b *InMemoryBackend) CreateSecret(req *secretmanagerpb.CreateSecretRequest) (*secretmanagerpb.Secret, error)

CreateSecret creates a secret under parent.

func (*InMemoryBackend) DeleteSecret 

func (b *InMemoryBackend) DeleteSecret(req *secretmanagerpb.DeleteSecretRequest) error

DeleteSecret removes a secret and all its versions; a non-empty etag must match.

func (*InMemoryBackend) DestroySecretVersion 

func (b *InMemoryBackend) DestroySecretVersion(
	req *secretmanagerpb.DestroySecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

DestroySecretVersion destroys a version now, or schedules it when the secret has version_destroy_ttl.

func (*InMemoryBackend) DisableSecretVersion 

func (b *InMemoryBackend) DisableSecretVersion(
	req *secretmanagerpb.DisableSecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

DisableSecretVersion moves an ENABLED version to DISABLED.

func (*InMemoryBackend) EnableManagedRotation 

func (b *InMemoryBackend) EnableManagedRotation(
	req *secretmanagerpb.EnableManagedRotationRequest,
) (*secretmanagerpb.SecretVersion, error)

EnableManagedRotation turns on managed rotation for a Cloud SQL credentials secret and adds the first version.

func (*InMemoryBackend) EnableSecretVersion 

func (b *InMemoryBackend) EnableSecretVersion(
	req *secretmanagerpb.EnableSecretVersionRequest,
) (*secretmanagerpb.SecretVersion, error)

EnableSecretVersion moves a DISABLED version back to ENABLED, cancelling any scheduled destruction.

func (*InMemoryBackend) FireRotations 

func (b *InMemoryBackend) FireRotations()

FireRotations delivers SECRET_ROTATE notifications for every secret whose next_rotation_time has passed.

func (*InMemoryBackend) GetIamPolicy 

func (b *InMemoryBackend) GetIamPolicy(resource string, version int32) (*iampb.Policy, error)

GetIamPolicy returns a secret's IAM policy at the requested version, or an empty policy when none is set.

func (*InMemoryBackend) GetSecret 

func (b *InMemoryBackend) GetSecret(name string) (*secretmanagerpb.Secret, error)

GetSecret returns a secret.

func (*InMemoryBackend) GetSecretVersion 

func (b *InMemoryBackend) GetSecretVersion(name string) (*secretmanagerpb.SecretVersion, error)

GetSecretVersion returns version metadata (no payload); name may use latest or an alias.

func (*InMemoryBackend) ListSecretVersions 

func (b *InMemoryBackend) ListSecretVersions(
	req *secretmanagerpb.ListSecretVersionsRequest,
) ([]*secretmanagerpb.SecretVersion, string, int, error)

ListSecretVersions returns a secret's versions newest first, and the total match count.

func (*InMemoryBackend) ListSecrets 

func (b *InMemoryBackend) ListSecrets(
	req *secretmanagerpb.ListSecretsRequest,
) ([]*secretmanagerpb.Secret, string, int, error)

ListSecrets returns the matching secrets of a project sorted by name, and the total match count.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot.

func (*InMemoryBackend) RotateSecret 

func (b *InMemoryBackend) RotateSecret(
	req *secretmanagerpb.RotateSecretRequest,
) (*secretmanagerpb.SecretVersion, error)

RotateSecret adds a freshly generated password version to a secret with managed rotation enabled.

func (*InMemoryBackend) RunJanitor 

func (b *InMemoryBackend) RunJanitor(ctx context.Context, every time.Duration)

RunJanitor sweeps expired secrets and due version destructions until ctx ends.

func (*InMemoryBackend) RunRotations 

func (b *InMemoryBackend) RunRotations(ctx context.Context, every time.Duration)

RunRotations fires due rotations every interval until ctx ends.

func (*InMemoryBackend) SetIamPolicy 

func (b *InMemoryBackend) SetIamPolicy(req *iampb.SetIamPolicyRequest) (*iampb.Policy, error)

SetIamPolicy replaces a secret's IAM policy; a non-empty etag must match the stored policy.

func (*InMemoryBackend) SetPublisher 

func (b *InMemoryBackend) SetPublisher(p TopicPublisher)

SetPublisher sets where SECRET_ROTATE notifications are delivered; nil disables delivery.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises all secrets, versions (with payloads) and policies.

func (*InMemoryBackend) Sweep 

func (b *InMemoryBackend) Sweep()

Sweep deletes expired secrets and finalises version destructions that are due.

func (*InMemoryBackend) TestIamPermissions 

func (b *InMemoryBackend) TestIamPermissions(
	req *iampb.TestIamPermissionsRequest,
) (*iampb.TestIamPermissionsResponse, error)

TestIamPermissions reports the requested Secret Manager permissions as granted; there is no authorization.

func (*InMemoryBackend) UpdateSecret 

func (b *InMemoryBackend) UpdateSecret(req *secretmanagerpb.UpdateSecretRequest) (*secretmanagerpb.Secret, error)

UpdateSecret applies the masked fields of req.Secret to the stored secret.

type Provider 

type Provider struct{}

Provider implements service.Provider for Google Secret Manager. It serves gRPC on its own listener (see Handler.StartWorker) and never matches on the shared AWS router.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler; the port is bound in StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type Settings 

type Settings struct {
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 180-byte string literal not displayed */
}

Settings holds service-level configuration, embedded in the root CLI command as CLI.GCPSecretManager.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider is available.

type TopicPublisher 

type TopicPublisher interface {
	Publish(topic string, data []byte, attrs map[string]string) error
}

TopicPublisher publishes a message to a Pub/Sub topic resource name (projects/p/topics/t).

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.