providers

package
v1.225.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 5, 2026 License: Apache-2.0 Imports: 61 Imported by: 0

Documentation

Overview

Package providers is a generated GoMock package.

Package providers is a generated GoMock package.

Package providers is a generated GoMock package.

Package providers is a generated GoMock package.

Package providers contains the concrete store backend implementations (AWS SSM Parameter Store, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault, Redis, Artifactory, 1Password, Keychain, GitHub Actions). Each backend registers itself with pkg/store via store.Register in its init() function, so importing this package — typically with a blank import — makes the built-in store kinds available to store.NewStoreRegistry.

Index

Constants

View Source 
const (

	// AzureKeyVaultHyphen is the hyphen character used for Azure Key Vault secret name normalization.
	AzureKeyVaultHyphen = "-"
)

Variables

This section is empty.

Functions

func NewArtifactoryStore 

func NewArtifactoryStore(options ArtifactoryStoreOptions) (store.Store, error)

func NewAzureKeyVaultStore 

func NewAzureKeyVaultStore(options AzureKeyVaultStoreOptions, identityName string) (store.Store, error)

NewAzureKeyVaultStore creates a new Azure Key Vault store. If identityName is non-empty, client initialization is deferred until first use (lazy init).

func NewGSMStore 

func NewGSMStore(options GSMStoreOptions, identityName string) (store.Store, error)

NewGSMStore initializes a new Google Secret Manager store.Store. Client initialization is always deferred to first use via ensureClient(). This allows auth credentials (e.g., GOOGLE_OAUTH_ACCESS_TOKEN) to be established after config loading but before the store is actually used.

func NewGitHubActionsStore 

func NewGitHubActionsStore(options *GitHubActionsStoreOptions) (store.Store, error)

NewGitHubActionsStore initializes a GitHub Actions secrets store. The GitHub client is built lazily on first API call, so this only validates required addressing options.

func NewKeychainStore 

func NewKeychainStore(options *KeychainStoreOptions) (store.Store, error)

NewKeychainStore initializes a keychain store. Constructing the system backend probes keyring availability, so an unusable keychain (e.g. a headless container) fails here rather than silently dropping writes.

func NewOnePasswordStore 

func NewOnePasswordStore(options *OnePasswordStoreOptions) (store.Store, error)

NewOnePasswordStore initializes a 1Password store. Credential selection is deferred until the first secret resolution (see getClient), so this never fails for missing credentials.

func NewRedisStore 

func NewRedisStore(options RedisStoreOptions) (store.Store, error)

func NewSSMStore 

func NewSSMStore(options SSMStoreOptions, identityName string) (store.Store, error)

NewSSMStore initializes a new SSMStore. Client initialization is deferred until first use so callers can inject an auth resolver after config load and before the first backend operation.

func NewSecretsManagerStore 

func NewSecretsManagerStore(options SecretsManagerStoreOptions, identityName string) (store.Store, error)

NewSecretsManagerStore initializes a new SecretsManagerStore. Client initialization is deferred until first use so callers can inject an auth resolver after config load and before the first backend operation.

func NewVaultStore 

func NewVaultStore(options *VaultStoreOptions, identityName string) (store.Store, error)

NewVaultStore initializes a new VaultStore using token authentication. The address may be supplied via options or the standard VAULT_ADDR environment variable (read by the Vault SDK); the token may be supplied via options or the standard VAULT_TOKEN environment variable.

Types

type ArtifactoryClient 

type ArtifactoryClient interface {
	DownloadFiles(...services.DownloadParams) (int, int, error)
	UploadFiles(artifactory.UploadServiceOptions, ...services.UploadParams) (int, int, error)
	// SearchFiles lists files matching an Ant-style pattern (metadata only, no content). Used by
	// Keys to enumerate keys under a stack/component scope.
	SearchFiles(services.SearchParams) (*content.ContentReader, error)
}

ArtifactoryClient interface allows us to mock the Artifactory Services Manager in test with only the methods we are using in the ArtifactoryStore.

type ArtifactoryStore 

type ArtifactoryStore struct {
	// contains filtered or unexported fields
}

func (*ArtifactoryStore) Get 

func (s *ArtifactoryStore) Get(stack string, component string, key string) (interface{}, error)

func (*ArtifactoryStore) GetKey 

func (s *ArtifactoryStore) GetKey(key string) (interface{}, error)

func (*ArtifactoryStore) Keys 

func (s *ArtifactoryStore) Keys(stack string, component string) ([]string, error)

Keys lists the keys under a stack/component scope (or globally when both are empty), via Artifactory's file search API with a recursive Ant-style pattern. Each match's repo-relative path (repo + path + name) has the store's repo+prefix segment stripped to recover the key.

func (*ArtifactoryStore) Set 

func (s *ArtifactoryStore) Set(stack string, component string, key string, value interface{}) error

type ArtifactoryStoreOptions 

type ArtifactoryStoreOptions struct {
	AccessToken    *string `mapstructure:"access_token"`
	Prefix         *string `mapstructure:"prefix"`
	RepoName       string  `mapstructure:"repo_name"`
	StackDelimiter *string `mapstructure:"stack_delimiter"`
	URL            string  `mapstructure:"url"`
}

type AzureKeyVaultClient 

type AzureKeyVaultClient interface {
	SetSecret(ctx context.Context, name string, parameters azsecrets.SetSecretParameters, options *azsecrets.SetSecretOptions) (azsecrets.SetSecretResponse, error)
	GetSecret(ctx context.Context, name string, version string, options *azsecrets.GetSecretOptions) (azsecrets.GetSecretResponse, error)
	DeleteSecret(ctx context.Context, name string, options *azsecrets.DeleteSecretOptions) (azsecrets.DeleteSecretResponse, error)
	// NewListSecretPropertiesVersionsPager lists the versions/properties of a single named secret
	// without ever returning the secret value, so existence can be confirmed via the "list"
	// permission instead of "get". Has() uses this to avoid retrieving the secret value.
	NewListSecretPropertiesVersionsPager(name string, options *azsecrets.ListSecretPropertiesVersionsOptions) *runtime.Pager[azsecrets.ListSecretPropertiesVersionsResponse]
	// NewListSecretPropertiesPager lists every secret's properties in the vault (metadata only,
	// no values). Azure Key Vault has no server-side name-prefix filter, so Keys uses this to
	// list everything and filters client-side.
	NewListSecretPropertiesPager(options *azsecrets.ListSecretPropertiesOptions) *runtime.Pager[azsecrets.ListSecretPropertiesResponse]
}

AzureKeyVaultClient interface allows us to mock the Azure Key Vault client.

type AzureKeyVaultStore 

type AzureKeyVaultStore struct {
	// contains filtered or unexported fields
}

AzureKeyVaultStore is an implementation of the store.Store interface for Azure Key Vault.

func (*AzureKeyVaultStore) Delete 

func (s *AzureKeyVaultStore) Delete(stack string, component string, key string) error

Delete removes a secret from Azure Key Vault for the given stack, component, and key.

func (*AzureKeyVaultStore) Get 

func (s *AzureKeyVaultStore) Get(stack string, component string, key string) (interface{}, error)

func (*AzureKeyVaultStore) GetKey 

func (s *AzureKeyVaultStore) GetKey(key string) (interface{}, error)

func (*AzureKeyVaultStore) Has 

func (s *AzureKeyVaultStore) Has(stack string, component string, key string) (bool, error)

Has reports whether a secret exists for the given stack, component, and key.

It uses the secret-versions listing API (NewListSecretPropertiesVersionsPager), which returns only secret metadata/properties and never the secret value. Existence is therefore confirmed without retrieving the value: a non-existent secret yields a 404 mapped to (false, nil), while any other error (e.g. permission denied) is wrapped and returned. Note that Azure Key Vault secrets have no separate "decrypt" permission distinct from "get"; the versions listing relies on the "list" permission and is the lightest existence check that avoids reading the value.

func (*AzureKeyVaultStore) IdentityName 

func (s *AzureKeyVaultStore) IdentityName() string

IdentityName returns the configured identity name, if any.

func (*AzureKeyVaultStore) Keys 

func (s *AzureKeyVaultStore) Keys(stack string, component string) ([]string, error)

Keys lists the secret names under a stack/component scope (or globally when both are empty). Azure Key Vault has no server-side name-prefix filter parameter, so this lists every secret in the vault and filters client-side by the normalized prefix.

func (*AzureKeyVaultStore) Set 

func (s *AzureKeyVaultStore) Set(stack string, component string, key string, value interface{}) error

func (*AzureKeyVaultStore) SetAuthContext 

func (s *AzureKeyVaultStore) SetAuthContext(resolver store.AuthContextResolver, identityName string)

SetAuthContext implements store.IdentityAwareStore. If identityName is non-empty, it overrides the store's identity. Otherwise, the existing identity is preserved.

type AzureKeyVaultStoreOptions 

type AzureKeyVaultStoreOptions struct {
	VaultURL                             string  `mapstructure:"vault_url"`
	Endpoint                             *string `mapstructure:"endpoint"`
	Prefix                               *string `mapstructure:"prefix"`
	StackDelimiter                       *string `mapstructure:"stack_delimiter"`
	DisableChallengeResourceVerification bool    `mapstructure:"disable_challenge_resource_verification"`
	WithoutAuthentication                bool    `mapstructure:"without_authentication"`
	InsecureAllowCredentialWithHTTP      bool    `mapstructure:"insecure_allow_credential_with_http"`
	EndpointInsecure                     bool    `mapstructure:"endpoint_insecure"`
}

type GSMClient 

type GSMClient interface {
	CreateSecret(ctx context.Context, req *secretmanagerpb.CreateSecretRequest, opts ...gax.CallOption) (*secretmanagerpb.Secret, error)
	AddSecretVersion(ctx context.Context, req *secretmanagerpb.AddSecretVersionRequest, opts ...gax.CallOption) (*secretmanagerpb.SecretVersion, error)
	AccessSecretVersion(ctx context.Context, req *secretmanagerpb.AccessSecretVersionRequest, opts ...gax.CallOption) (*secretmanagerpb.AccessSecretVersionResponse, error)
	GetSecretVersion(ctx context.Context, req *secretmanagerpb.GetSecretVersionRequest, opts ...gax.CallOption) (*secretmanagerpb.SecretVersion, error)
	DeleteSecret(ctx context.Context, req *secretmanagerpb.DeleteSecretRequest, opts ...gax.CallOption) error
	// ListSecrets returns an iterator (unlike the other methods here) rather than a
	// (response, error) pair, matching the underlying secretmanager.Client.ListSecrets signature.
	ListSecrets(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) SecretIterator
	Close() error
}

GSMClient is the interface that wraps the Google Secret Manager client methods we use.

type GSMStore 

type GSMStore struct {
	// contains filtered or unexported fields
}

GSMStore is an implementation of the store.Store interface for Google Secret Manager.

func (*GSMStore) Delete 

func (s *GSMStore) Delete(stack string, component string, key string) error

Delete removes a secret (and all its versions) from Google Secret Manager for the given stack, component, and key. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*GSMStore) Get 

func (s *GSMStore) Get(stack string, component string, key string) (any, error)

Get retrieves a value by key from Google Secret Manager. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*GSMStore) GetKey 

func (s *GSMStore) GetKey(key string) (interface{}, error)

GetKey retrieves a secret value directly by its key name, without stack/component scoping.

func (*GSMStore) Has 

func (s *GSMStore) Has(stack string, component string, key string) (bool, error)

Has reports whether a secret exists for the given stack, component, and key. It queries the latest version's metadata via GetSecretVersion, which does NOT access or decrypt the secret payload. A not-found result maps to false; any other error is propagated.

func (*GSMStore) IdentityName 

func (s *GSMStore) IdentityName() string

IdentityName returns the configured identity name, if any.

func (*GSMStore) Keys 

func (s *GSMStore) Keys(stack string, component string) ([]string, error)

Keys lists the secret names under a stack/component scope (or globally when both are empty), via Secret Manager's ListSecrets. Its filter field is a substring/wildcard match, not a guaranteed prefix, so each returned secret ID is also verified client-side before its prefix is stripped.

func (*GSMStore) Set 

func (s *GSMStore) Set(stack string, component string, key string, value any) error

Set stores a key-value pair in Google Secret Manager. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*GSMStore) SetAuthContext 

func (s *GSMStore) SetAuthContext(resolver store.AuthContextResolver, identityName string)

SetAuthContext implements store.IdentityAwareStore. If identityName is non-empty, it overrides the store's identity. Otherwise, the existing identity is preserved.

type GSMStoreOptions 

type GSMStoreOptions struct {
	Prefix                *string   `mapstructure:"prefix"`
	ProjectID             string    `mapstructure:"project_id"`
	StackDelimiter        *string   `mapstructure:"stack_delimiter"`
	Credentials           *string   `mapstructure:"credentials"` // Optional JSON credentials
	Locations             *[]string `mapstructure:"locations"`   // Optional replication locations
	Endpoint              *string   `mapstructure:"endpoint"`
	EndpointURL           *string   `mapstructure:"endpoint_url"`
	EndpointInsecure      bool      `mapstructure:"endpoint_insecure"`
	WithoutAuthentication bool      `mapstructure:"without_authentication"`
}

GSMStoreOptions defines the configuration options for Google Secret Manager store.

type GitHubActionsCIOptions 

type GitHubActionsCIOptions struct {
	// Enabled forces value reads (Get) on even when GitHub Actions is not auto-detected. By
	// default reads are allowed only inside a GitHub Actions runner (see actions.IsGitHubActions).
	Enabled bool `mapstructure:"enabled"`
}

GitHubActionsCIOptions gates value reads for a GitHub Actions store.

type GitHubActionsStore 

type GitHubActionsStore struct {
	// contains filtered or unexported fields
}

GitHubActionsStore implements the store.Store interface backed by GitHub Actions secrets. It is a "native CI" store: Set/Has/Delete go through the GitHub API, while Get reads the value from the process environment (only populated inside a runner) and is gated by CI detection.

func (*GitHubActionsStore) Delete 

func (s *GitHubActionsStore) Delete(_ string, _ string, key string) error

Delete removes the secret via the GitHub API. It is idempotent: a missing secret is not an error.

func (*GitHubActionsStore) Get 

func (s *GitHubActionsStore) Get(_ string, _ string, key string) (any, error)

Get returns the secret value from the process environment. This only works inside a GitHub Actions runner (where GitHub injects the secret), gated by CI detection; the GitHub API never exposes secret values.

func (*GitHubActionsStore) GetKey 

func (s *GitHubActionsStore) GetKey(key string) (any, error)

GetKey returns the secret value for a raw key without stack/component context (same env-read semantics as Get).

func (*GitHubActionsStore) Has 

func (s *GitHubActionsStore) Has(_ string, _ string, key string) (bool, error)

Has reports whether the secret exists, via the GitHub API (metadata only, no value, no CI context). A missing secret returns (false, nil); auth/transport errors propagate.

func (*GitHubActionsStore) Keys 

func (s *GitHubActionsStore) Keys(_ string, _ string) ([]string, error)

Keys lists the secret names in this store's scope (repository or environment), via the GitHub API. GitHub Actions secrets are a flat, repo-global namespace (see the type doc): stack and component are accepted for interface conformance but do not affect the result. Every secret name is uppercase with underscores (see toEnvIdentifier) — that transform is lossy, so a returned name may not exactly match the original key's casing/characters.

func (*GitHubActionsStore) Set 

func (s *GitHubActionsStore) Set(_ string, _ string, key string, value any) error

Set encrypts and writes a secret value via the GitHub API. The stack and component do not affect the secret name (GitHub secrets are a flat, repo-global namespace).

func (*GitHubActionsStore) ValueListingSupported 

func (s *GitHubActionsStore) ValueListingSupported() bool

ValueListingSupported reports whether Get can currently be called for every key Keys returns -- true only inside a GitHub Actions runner (or with options.ci.enabled), mirroring readAllowed. Service.ListKeyValues checks this before enumerating so `store list STORE` fails fast with ErrListNotSupported instead of aborting mid-enumeration on the first Get error.

type GitHubActionsStoreOptions 

type GitHubActionsStoreOptions struct {
	// Owner is the repository owner (org or user). Required.
	Owner string `mapstructure:"owner"`
	// Repo is the repository name. Required.
	Repo string `mapstructure:"repo"`
	// Environment optionally targets environment-level secrets instead of repository secrets.
	Environment string `mapstructure:"environment"`
	// Prefix is an optional name prefix applied before the key (e.g. prefix "atmos" + key
	// "db_password" → secret "ATMOS_DB_PASSWORD").
	Prefix string `mapstructure:"prefix"`
	// Token optionally overrides the GitHub token; when empty the standard Atmos resolution chain
	// is used (--github-token → ATMOS_GITHUB_TOKEN → GITHUB_TOKEN → `gh auth token`).
	Token string `mapstructure:"token"`
	// CI gates value reads (Get).
	CI GitHubActionsCIOptions `mapstructure:"ci"`
}

GitHubActionsStoreOptions configures a GitHub Actions secrets store. Secrets are written, listed, and deleted through the GitHub API (anywhere a token is available), but their *values* can only be read back inside a GitHub Actions runner, where GitHub injects the secret into the environment. Addressing is flat: a secret is named [PREFIX_]KEY (uppercased), repo-global, so the same key resolves to the same GitHub secret across stacks/components.

type KeychainStore 

type KeychainStore struct {
	// contains filtered or unexported fields
}

KeychainStore implements a writable Store over an OS keychain or encrypted file via pkg/keyring.

func (*KeychainStore) Delete 

func (s *KeychainStore) Delete(stack string, component string, key string) error

Delete removes the value for the stack/component/key triple. It is idempotent.

func (*KeychainStore) Get 

func (s *KeychainStore) Get(stack string, component string, key string) (any, error)

Get retrieves the value for the stack/component/key triple.

func (*KeychainStore) GetKey 

func (s *KeychainStore) GetKey(key string) (any, error)

GetKey retrieves a value directly by its composed key, without stack/component context.

func (*KeychainStore) Has 

func (s *KeychainStore) Has(stack string, component string, key string) (bool, error)

Has reports whether a value exists for the stack/component/key triple. It uses the keyring's native existence check — no value is retrieved or decrypted.

func (*KeychainStore) IsLocal 

func (s *KeychainStore) IsLocal() bool

IsLocal reports that the OS keychain operates without network access or authentication, so `atmos secret list` can check its status for free (no --verify needed). Implements LocalStore.

func (*KeychainStore) Keys 

func (s *KeychainStore) Keys(stack string, component string) ([]string, error)

Keys lists the keys under a stack/component scope (or globally when both are empty). The keychain's default (system/OS) backend returns store.ErrListNotSupported: the underlying go-keyring library cannot enumerate entries on macOS Keychain, Windows Credential Manager, or Linux Secret Service — this is a permanent limitation of that library, not a per-platform gap. The file and memory backends do support it.

func (*KeychainStore) Set 

func (s *KeychainStore) Set(stack string, component string, key string, value any) error

Set stores a value for the stack/component/key triple. The value is JSON-encoded so any type round-trips through the string-valued keyring.

type KeychainStoreOptions 

type KeychainStoreOptions struct {
	// Backend selects the keyring backend: "system" (OS keychain, default), "file" (encrypted
	// file), or "memory" (testing).
	Backend string `mapstructure:"backend"`
	// Service namespaces the entries. Defaults to "atmos-secrets".
	Service string `mapstructure:"service"`
	// FileDir is the directory for the file backend (defaults to the XDG data dir).
	FileDir string `mapstructure:"file_dir"`
	// PasswordEnv names the environment variable holding the file-backend password (defaults to
	// ATMOS_KEYRING_PASSWORD).
	PasswordEnv string `mapstructure:"password_env"`
	// Prefix is prepended to every composed key. Defaults to "atmos".
	Prefix string `mapstructure:"prefix"`
	// StackDelimiter splits the stack into key segments. Defaults to "-". A pointer distinguishes
	// "unset" (use default) from an explicit empty string.
	StackDelimiter *string `mapstructure:"stack_delimiter"`
}

KeychainStoreOptions configures a keychain secret store backed by pkg/keyring. Unlike the read-only cloud stores, a keychain store is writable, making it a good local-development backend for `atmos secret set/get/delete` (and a place to keep bootstrap credentials like a 1Password token or a SOPS age key).

type MockArtifactoryClient 

type MockArtifactoryClient struct {
	// contains filtered or unexported fields
}

MockArtifactoryClient is a mock of ArtifactoryClient interface.

func NewMockArtifactoryClient 

func NewMockArtifactoryClient(ctrl *gomock.Controller) *MockArtifactoryClient

NewMockArtifactoryClient creates a new mock instance.

func (*MockArtifactoryClient) DownloadFiles 

func (m *MockArtifactoryClient) DownloadFiles(arg0 ...services.DownloadParams) (int, int, error)

DownloadFiles mocks base method.

func (*MockArtifactoryClient) EXPECT 

func (m *MockArtifactoryClient) EXPECT() *MockArtifactoryClientMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockArtifactoryClient) SearchFiles 

func (m *MockArtifactoryClient) SearchFiles(arg0 services.SearchParams) (*content.ContentReader, error)

SearchFiles mocks base method.

func (*MockArtifactoryClient) UploadFiles 

func (m *MockArtifactoryClient) UploadFiles(arg0 artifactory.UploadServiceOptions, arg1 ...services.UploadParams) (int, int, error)

UploadFiles mocks base method.

type MockArtifactoryClientMockRecorder 

type MockArtifactoryClientMockRecorder struct {
	// contains filtered or unexported fields
}

MockArtifactoryClientMockRecorder is the mock recorder for MockArtifactoryClient.

func (*MockArtifactoryClientMockRecorder) DownloadFiles 

func (mr *MockArtifactoryClientMockRecorder) DownloadFiles(arg0 ...any) *gomock.Call

DownloadFiles indicates an expected call of DownloadFiles.

func (*MockArtifactoryClientMockRecorder) SearchFiles 

func (mr *MockArtifactoryClientMockRecorder) SearchFiles(arg0 any) *gomock.Call

SearchFiles indicates an expected call of SearchFiles.

func (*MockArtifactoryClientMockRecorder) UploadFiles 

func (mr *MockArtifactoryClientMockRecorder) UploadFiles(arg0 any, arg1 ...any) *gomock.Call

UploadFiles indicates an expected call of UploadFiles.

type MockGSMClient 

type MockGSMClient struct {
	// contains filtered or unexported fields
}

MockGSMClient is a mock of GSMClient interface.

func NewMockGSMClient 

func NewMockGSMClient(ctrl *gomock.Controller) *MockGSMClient

NewMockGSMClient creates a new mock instance.

func (*MockGSMClient) AccessSecretVersion 

func (m *MockGSMClient) AccessSecretVersion(ctx context.Context, req *secretmanagerpb.AccessSecretVersionRequest, opts ...gax.CallOption) (*secretmanagerpb.AccessSecretVersionResponse, error)

AccessSecretVersion mocks base method.

func (*MockGSMClient) AddSecretVersion 

func (m *MockGSMClient) AddSecretVersion(ctx context.Context, req *secretmanagerpb.AddSecretVersionRequest, opts ...gax.CallOption) (*secretmanagerpb.SecretVersion, error)

AddSecretVersion mocks base method.

func (*MockGSMClient) Close 

func (m *MockGSMClient) Close() error

Close mocks base method.

func (*MockGSMClient) CreateSecret 

func (m *MockGSMClient) CreateSecret(ctx context.Context, req *secretmanagerpb.CreateSecretRequest, opts ...gax.CallOption) (*secretmanagerpb.Secret, error)

CreateSecret mocks base method.

func (*MockGSMClient) DeleteSecret 

func (m *MockGSMClient) DeleteSecret(ctx context.Context, req *secretmanagerpb.DeleteSecretRequest, opts ...gax.CallOption) error

DeleteSecret mocks base method.

func (*MockGSMClient) EXPECT 

func (m *MockGSMClient) EXPECT() *MockGSMClientMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockGSMClient) GetSecretVersion 

func (m *MockGSMClient) GetSecretVersion(ctx context.Context, req *secretmanagerpb.GetSecretVersionRequest, opts ...gax.CallOption) (*secretmanagerpb.SecretVersion, error)

GetSecretVersion mocks base method.

func (*MockGSMClient) ListSecrets 

func (m *MockGSMClient) ListSecrets(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) SecretIterator

ListSecrets mocks base method.

type MockGSMClientMockRecorder 

type MockGSMClientMockRecorder struct {
	// contains filtered or unexported fields
}

MockGSMClientMockRecorder is the mock recorder for MockGSMClient.

func (*MockGSMClientMockRecorder) AccessSecretVersion 

func (mr *MockGSMClientMockRecorder) AccessSecretVersion(ctx, req any, opts ...any) *gomock.Call

AccessSecretVersion indicates an expected call of AccessSecretVersion.

func (*MockGSMClientMockRecorder) AddSecretVersion 

func (mr *MockGSMClientMockRecorder) AddSecretVersion(ctx, req any, opts ...any) *gomock.Call

AddSecretVersion indicates an expected call of AddSecretVersion.

func (*MockGSMClientMockRecorder) Close 

func (mr *MockGSMClientMockRecorder) Close() *gomock.Call

Close indicates an expected call of Close.

func (*MockGSMClientMockRecorder) CreateSecret 

func (mr *MockGSMClientMockRecorder) CreateSecret(ctx, req any, opts ...any) *gomock.Call

CreateSecret indicates an expected call of CreateSecret.

func (*MockGSMClientMockRecorder) DeleteSecret 

func (mr *MockGSMClientMockRecorder) DeleteSecret(ctx, req any, opts ...any) *gomock.Call

DeleteSecret indicates an expected call of DeleteSecret.

func (*MockGSMClientMockRecorder) GetSecretVersion 

func (mr *MockGSMClientMockRecorder) GetSecretVersion(ctx, req any, opts ...any) *gomock.Call

GetSecretVersion indicates an expected call of GetSecretVersion.

func (*MockGSMClientMockRecorder) ListSecrets 

func (mr *MockGSMClientMockRecorder) ListSecrets(ctx, req any, opts ...any) *gomock.Call

ListSecrets indicates an expected call of ListSecrets.

type MockRedisClient 

type MockRedisClient struct {
	// contains filtered or unexported fields
}

MockRedisClient is a mock of RedisClient interface.

func NewMockRedisClient 

func NewMockRedisClient(ctrl *gomock.Controller) *MockRedisClient

NewMockRedisClient creates a new mock instance.

func (*MockRedisClient) EXPECT 

func (m *MockRedisClient) EXPECT() *MockRedisClientMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockRedisClient) Get 

func (m *MockRedisClient) Get(ctx context.Context, key string) *redis.StringCmd

Get mocks base method.

func (*MockRedisClient) Scan 

func (m *MockRedisClient) Scan(ctx context.Context, cursor uint64, match string, count int64) *redis.ScanCmd

Scan mocks base method.

func (*MockRedisClient) Set 

func (m *MockRedisClient) Set(ctx context.Context, key string, value any, expiration time.Duration) *redis.StatusCmd

Set mocks base method.

type MockRedisClientMockRecorder 

type MockRedisClientMockRecorder struct {
	// contains filtered or unexported fields
}

MockRedisClientMockRecorder is the mock recorder for MockRedisClient.

func (*MockRedisClientMockRecorder) Get 

func (mr *MockRedisClientMockRecorder) Get(ctx, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockRedisClientMockRecorder) Scan 

func (mr *MockRedisClientMockRecorder) Scan(ctx, cursor, match, count any) *gomock.Call

Scan indicates an expected call of Scan.

func (*MockRedisClientMockRecorder) Set 

func (mr *MockRedisClientMockRecorder) Set(ctx, key, value, expiration any) *gomock.Call

Set indicates an expected call of Set.

type MockSSMClient 

type MockSSMClient struct {
	// contains filtered or unexported fields
}

MockSSMClient is a mock of SSMClient interface.

func NewMockSSMClient 

func NewMockSSMClient(ctrl *gomock.Controller) *MockSSMClient

NewMockSSMClient creates a new mock instance.

func (*MockSSMClient) DeleteParameter 

func (m *MockSSMClient) DeleteParameter(ctx context.Context, params *ssm.DeleteParameterInput, optFns ...func(*ssm.Options)) (*ssm.DeleteParameterOutput, error)

DeleteParameter mocks base method.

func (*MockSSMClient) EXPECT 

func (m *MockSSMClient) EXPECT() *MockSSMClientMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockSSMClient) GetParameter 

func (m *MockSSMClient) GetParameter(ctx context.Context, params *ssm.GetParameterInput, optFns ...func(*ssm.Options)) (*ssm.GetParameterOutput, error)

GetParameter mocks base method.

func (*MockSSMClient) GetParametersByPath 

func (m *MockSSMClient) GetParametersByPath(ctx context.Context, params *ssm.GetParametersByPathInput, optFns ...func(*ssm.Options)) (*ssm.GetParametersByPathOutput, error)

GetParametersByPath mocks base method.

func (*MockSSMClient) PutParameter 

func (m *MockSSMClient) PutParameter(ctx context.Context, params *ssm.PutParameterInput, optFns ...func(*ssm.Options)) (*ssm.PutParameterOutput, error)

PutParameter mocks base method.

type MockSSMClientMockRecorder 

type MockSSMClientMockRecorder struct {
	// contains filtered or unexported fields
}

MockSSMClientMockRecorder is the mock recorder for MockSSMClient.

func (*MockSSMClientMockRecorder) DeleteParameter 

func (mr *MockSSMClientMockRecorder) DeleteParameter(ctx, params any, optFns ...any) *gomock.Call

DeleteParameter indicates an expected call of DeleteParameter.

func (*MockSSMClientMockRecorder) GetParameter 

func (mr *MockSSMClientMockRecorder) GetParameter(ctx, params any, optFns ...any) *gomock.Call

GetParameter indicates an expected call of GetParameter.

func (*MockSSMClientMockRecorder) GetParametersByPath 

func (mr *MockSSMClientMockRecorder) GetParametersByPath(ctx, params any, optFns ...any) *gomock.Call

GetParametersByPath indicates an expected call of GetParametersByPath.

func (*MockSSMClientMockRecorder) PutParameter 

func (mr *MockSSMClientMockRecorder) PutParameter(ctx, params any, optFns ...any) *gomock.Call

PutParameter indicates an expected call of PutParameter.

type MockSTSClient 

type MockSTSClient struct {
	// contains filtered or unexported fields
}

MockSTSClient is a mock of STSClient interface.

func NewMockSTSClient 

func NewMockSTSClient(ctrl *gomock.Controller) *MockSTSClient

NewMockSTSClient creates a new mock instance.

func (*MockSTSClient) AssumeRole 

func (m *MockSTSClient) AssumeRole(ctx context.Context, params *sts.AssumeRoleInput, optFns ...func(*sts.Options)) (*sts.AssumeRoleOutput, error)

AssumeRole mocks base method.

func (*MockSTSClient) EXPECT 

func (m *MockSTSClient) EXPECT() *MockSTSClientMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

type MockSTSClientMockRecorder 

type MockSTSClientMockRecorder struct {
	// contains filtered or unexported fields
}

MockSTSClientMockRecorder is the mock recorder for MockSTSClient.

func (*MockSTSClientMockRecorder) AssumeRole 

func (mr *MockSTSClientMockRecorder) AssumeRole(ctx, params any, optFns ...any) *gomock.Call

AssumeRole indicates an expected call of AssumeRole.

type MockSecretIterator 

type MockSecretIterator struct {
	// contains filtered or unexported fields
}

MockSecretIterator is a mock of SecretIterator interface.

func NewMockSecretIterator 

func NewMockSecretIterator(ctrl *gomock.Controller) *MockSecretIterator

NewMockSecretIterator creates a new mock instance.

func (*MockSecretIterator) EXPECT 

func (m *MockSecretIterator) EXPECT() *MockSecretIteratorMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockSecretIterator) Next 

func (m *MockSecretIterator) Next() (*secretmanagerpb.Secret, error)

Next mocks base method.

type MockSecretIteratorMockRecorder 

type MockSecretIteratorMockRecorder struct {
	// contains filtered or unexported fields
}

MockSecretIteratorMockRecorder is the mock recorder for MockSecretIterator.

func (*MockSecretIteratorMockRecorder) Next 

func (mr *MockSecretIteratorMockRecorder) Next() *gomock.Call

Next indicates an expected call of Next.

type OnePasswordStore 

type OnePasswordStore struct {
	// contains filtered or unexported fields
}

OnePasswordStore implements the Store interface backed by 1Password. It resolves templated `op://` references via either the native SDK (service account) or Connect (REST). Writes (Set/Delete) create/update/remove the field the reference points to (creating the item if needed); created items use the API Credential category with a Concealed value field.

func (*OnePasswordStore) Delete 

func (s *OnePasswordStore) Delete(stack string, component string, key string) error

Delete removes the field the templated reference points to (deleting the item if it becomes empty). It is idempotent: a missing vault/item/field is not an error.

func (*OnePasswordStore) Get 

func (s *OnePasswordStore) Get(stack string, component string, key string) (any, error)

Get resolves the templated reference (carried as `key`) for the given stack/component.

func (*OnePasswordStore) GetKey 

func (s *OnePasswordStore) GetKey(key string) (any, error)

GetKey resolves a raw reference without stack/component context (templated vars render empty).

func (*OnePasswordStore) Has 

func (s *OnePasswordStore) Has(stack string, component string, key string) (bool, error)

Has reports whether the referenced secret exists, treating a not-found reference as absence while propagating auth/transport errors. When the underlying client supports a metadata-only existence check (onePasswordExistenceChecker), Has uses it so that probing for existence does not reveal/retrieve the secret value. Otherwise it falls back to a value-resolving probe.

Both production clients (native SDK and Connect) implement the metadata-only Exists check, so in practice Has never resolves the value. The value-resolving fallback remains only for clients that do not opt into onePasswordExistenceChecker.

func (*OnePasswordStore) Set 

func (s *OnePasswordStore) Set(stack string, component string, key string, value any) error

Set creates or updates the field the templated reference (carried as `key`) points to, creating the 1Password item if it does not yet exist.

type OnePasswordStoreOptions 

type OnePasswordStoreOptions struct {
	// Mode selects the integration backend: "auto" (default), "connect", or "service-account".
	Mode string `mapstructure:"mode"`
	// Token is the service-account token; falls back to OP_SERVICE_ACCOUNT_TOKEN.
	Token string `mapstructure:"token"`
	// ConnectHost is the 1Password Connect server URL; falls back to OP_CONNECT_HOST.
	ConnectHost string `mapstructure:"connect_host"`
	// ConnectToken is the 1Password Connect API token; falls back to OP_CONNECT_TOKEN.
	ConnectToken string `mapstructure:"connect_token"`
	// Vault optionally supplies a default vault, letting references omit the scheme and vault
	// (e.g. `Datadog/api_key` becomes `op://<vault>/Datadog/api_key`).
	Vault string `mapstructure:"vault"`
}

OnePasswordStoreOptions configures a 1Password store. Addressing is reference-based: each declared secret carries an `op://...` reference (optionally Go-templated), so there is no prefix/stack-delimiter key composition like the other stores.

type RedisClient 

type RedisClient interface {
	Get(ctx context.Context, key string) *redis.StringCmd
	Set(ctx context.Context, key string, value interface{}, expiration time.Duration) *redis.StatusCmd
	// Scan iterates the keyspace with a cursor, matching a MATCH glob pattern. Used by Keys
	// instead of the KEYS command, which blocks the server on a large keyspace.
	Scan(ctx context.Context, cursor uint64, match string, count int64) *redis.ScanCmd
}

RedisClient interface allows us to mock the Redis Client in test with only the methods we are using in the RedisStore.

type RedisStore 

type RedisStore struct {
	// contains filtered or unexported fields
}

func (*RedisStore) Get 

func (s *RedisStore) Get(stack string, component string, key string) (interface{}, error)

func (*RedisStore) GetKey 

func (s *RedisStore) GetKey(key string) (interface{}, error)

func (*RedisStore) Keys 

func (s *RedisStore) Keys(stack string, component string) ([]string, error)

Keys lists the keys under a stack/component scope (or globally when both are empty), via Redis SCAN with a MATCH glob pattern. SCAN is used instead of KEYS, which blocks the server on a large keyspace; it gives no strong consistency guarantee (keys added/removed mid-scan may or may not appear), which is acceptable for a "list what's roughly there" result. The pattern is segment-bounded (prefix + "/*", not prefix + "*") and the prefix's glob metacharacters are escaped, so a scoped scan can't over-match a same-level sibling (e.g. "vpc2" when scoped to "vpc") or treat a literal "*"/"?"/"["/"]" in a stack or component name as a wildcard.

func (*RedisStore) RedisClient 

func (s *RedisStore) RedisClient() RedisClient

RedisClient returns the underlying Redis client for testing purposes.

func (*RedisStore) Set 

func (s *RedisStore) Set(stack string, component string, key string, value interface{}) error

type RedisStoreOptions 

type RedisStoreOptions struct {
	Prefix         *string `mapstructure:"prefix"`
	StackDelimiter *string `mapstructure:"stack_delimiter"`
	URL            *string `mapstructure:"url"`
}

type SSMClient 

type SSMClient interface {
	PutParameter(ctx context.Context, params *ssm.PutParameterInput, optFns ...func(*ssm.Options)) (*ssm.PutParameterOutput, error)
	GetParameter(ctx context.Context, params *ssm.GetParameterInput, optFns ...func(*ssm.Options)) (*ssm.GetParameterOutput, error)
	DeleteParameter(ctx context.Context, params *ssm.DeleteParameterInput, optFns ...func(*ssm.Options)) (*ssm.DeleteParameterOutput, error)
	GetParametersByPath(ctx context.Context, params *ssm.GetParametersByPathInput, optFns ...func(*ssm.Options)) (*ssm.GetParametersByPathOutput, error)
}

SSMClient interface allows us to mock the AWS SSM client.

type SSMStore 

type SSMStore struct {
	// contains filtered or unexported fields
}

SSMStore is an implementation of the store.Store interface for AWS SSM Parameter store.Store.

func (*SSMStore) Delete 

func (s *SSMStore) Delete(stack string, component string, key string) error

Delete removes a parameter for an Atmos component in a stack from AWS SSM Parameter Store. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*SSMStore) Get 

func (s *SSMStore) Get(stack string, component string, key string) (any, error)

Get retrieves a value by key for an Atmos component in a stack from AWS SSM Parameter Store. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*SSMStore) GetKey 

func (s *SSMStore) GetKey(key string) (any, error)

GetKey retrieves a value by key from AWS SSM Parameter store.Store.

func (*SSMStore) Has 

func (s *SSMStore) Has(stack string, component string, key string) (bool, error)

Has reports whether a parameter exists for an Atmos component in a stack. It performs an existence check WITHOUT decryption: GetParameter is called with WithDecryption=false, so it returns whether the parameter exists without requiring kms:Decrypt and without retrieving the plaintext value. A not-found error is treated as a non-existent (uninitialized) value.

func (*SSMStore) IdentityName 

func (s *SSMStore) IdentityName() string

IdentityName returns the configured identity name, if any.

func (*SSMStore) Keys 

func (s *SSMStore) Keys(stack string, component string) ([]string, error)

Keys lists the parameter names under a stack/component scope (or globally when both are empty), via SSM's GetParametersByPath (recursive). WithDecryption is false: only names are needed, so no kms:Decrypt permission is required.

func (*SSMStore) Set 

func (s *SSMStore) Set(stack string, component string, key string, value any) error

Set stores a key-value pair in AWS SSM Parameter Store. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*SSMStore) SetAuthContext 

func (s *SSMStore) SetAuthContext(resolver store.AuthContextResolver, identityName string)

SetAuthContext implements store.IdentityAwareStore. If identityName is non-empty, it overrides the store's identity. Otherwise, the existing identity is preserved.

func (*SSMStore) SetSecret 

func (s *SSMStore) SetSecret(secret bool)

SetSecret implements store.SecretAwareStore. When true, writes use the SecureString type.

type SSMStoreOptions 

type SSMStoreOptions struct {
	Prefix         *string `mapstructure:"prefix"`
	Region         string  `mapstructure:"region"`
	StackDelimiter *string `mapstructure:"stack_delimiter"`
	ReadRoleArn    *string `mapstructure:"read_role_arn"`
	WriteRoleArn   *string `mapstructure:"write_role_arn"`
	Endpoint       *string `mapstructure:"endpoint"`
	EndpointURL    *string `mapstructure:"endpoint_url"`
}

type STSClient 

type STSClient interface {
	AssumeRole(ctx context.Context, params *sts.AssumeRoleInput, optFns ...func(*sts.Options)) (*sts.AssumeRoleOutput, error)
}

STSClient interface allows us to mock the AWS STS client.

type SecretIterator 

type SecretIterator interface {
	Next() (*secretmanagerpb.Secret, error)
}

SecretIterator abstracts the paging behavior Keys consumes from ListSecrets (just Next). The real *secretmanager.SecretIterator satisfies this structurally via its exported Next method -- its paging state is otherwise unexported, so it can't be constructed by a test double; this narrower interface is what makes ListSecrets mockable at all. See gsmClientAdapter, which narrows the real SDK client's wider return type to this interface.

type SecretsManagerClient 

type SecretsManagerClient interface {
	CreateSecret(ctx context.Context, params *secretsmanager.CreateSecretInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.CreateSecretOutput, error)
	PutSecretValue(ctx context.Context, params *secretsmanager.PutSecretValueInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.PutSecretValueOutput, error)
	GetSecretValue(ctx context.Context, params *secretsmanager.GetSecretValueInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.GetSecretValueOutput, error)
	DescribeSecret(ctx context.Context, params *secretsmanager.DescribeSecretInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.DescribeSecretOutput, error)
	DeleteSecret(ctx context.Context, params *secretsmanager.DeleteSecretInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.DeleteSecretOutput, error)
	ListSecrets(ctx context.Context, params *secretsmanager.ListSecretsInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.ListSecretsOutput, error)
}

SecretsManagerClient is the subset of the AWS Secrets Manager API used by the store.

type SecretsManagerStore 

type SecretsManagerStore struct {
	// contains filtered or unexported fields
}

SecretsManagerStore is an implementation of the Store interface for AWS Secrets Manager. Unlike SSM Parameter Store, Secrets Manager is encrypted at rest by default and is suited to structured/JSON secrets, rotation, and larger values.

func (*SecretsManagerStore) Delete 

func (s *SecretsManagerStore) Delete(stack string, component string, key string) error

Delete removes a secret (with no recovery window so the name can be reused immediately). An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*SecretsManagerStore) Get 

func (s *SecretsManagerStore) Get(stack string, component string, key string) (any, error)

Get retrieves a value for an Atmos component in a stack. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*SecretsManagerStore) GetKey 

func (s *SecretsManagerStore) GetKey(key string) (any, error)

GetKey retrieves a value by its raw secret id (optionally prefixed).

func (*SecretsManagerStore) Has 

func (s *SecretsManagerStore) Has(stack string, component string, key string) (bool, error)

Has reports whether a secret exists, treating ResourceNotFound as non-existent. It uses DescribeSecret, which returns only metadata, so existence can be checked without retrieving or decrypting the secret value (no decrypt-capable identity required).

func (*SecretsManagerStore) IdentityName 

func (s *SecretsManagerStore) IdentityName() string

IdentityName returns the configured identity for default identity inheritance.

func (*SecretsManagerStore) Keys 

func (s *SecretsManagerStore) Keys(stack string, component string) ([]string, error)

Keys lists the secret names under a stack/component scope (or globally when both are empty), via Secrets Manager's ListSecrets with a "name" filter. That filter is a server-side, case-sensitive prefix match on raw characters, not on path segments, so it can return same-level siblings (e.g. "prod/api-backup" when scoped to "prod/api"); each returned name is re-checked client-side against the segment-bounded prefix (trimPrefix, which includes the trailing separator) before it's trusted and trimmed.

func (*SecretsManagerStore) Set 

func (s *SecretsManagerStore) Set(stack string, component string, key string, value any) error

Set stores a value, creating the secret if it does not yet exist. An empty stack and/or component is permitted: scoped secret coordinates (stack/global scope) omit those path segments.

func (*SecretsManagerStore) SetAuthContext 

func (s *SecretsManagerStore) SetAuthContext(resolver store.AuthContextResolver, identityName string)

SetAuthContext implements IdentityAwareStore.

type SecretsManagerStoreOptions 

type SecretsManagerStoreOptions struct {
	Prefix         *string `mapstructure:"prefix"`
	Region         string  `mapstructure:"region"`
	StackDelimiter *string `mapstructure:"stack_delimiter"`
	Endpoint       *string `mapstructure:"endpoint"`
	EndpointURL    *string `mapstructure:"endpoint_url"`
}

SecretsManagerStoreOptions configures an AWS Secrets Manager store.

type VaultKVClient 

type VaultKVClient interface {
	Put(ctx context.Context, path string, data map[string]any) error
	Get(ctx context.Context, path string) (map[string]any, error)
	Delete(ctx context.Context, path string) error
	// HasMetadata reports whether a secret exists at the path by reading the KV v2 metadata
	// endpoint (secret/metadata/<path>), which returns no secret values. A missing secret must
	// surface as a not-found error (vault.ErrSecretNotFound or a 404 ResponseError) so callers
	// can map it to absence via isVaultNotFound.
	HasMetadata(ctx context.Context, path string) error
	// List returns the immediate child key/folder names under path, via the KV v2 metadata LIST
	// operation (secret/metadata/<path>). Vault's LIST is directory-scoped: it returns only the
	// entries directly under path, not a deep recursive listing.
	List(ctx context.Context, path string) ([]string, error)
}

VaultKVClient abstracts the Vault KV v2 operations the store needs (for testability).

type VaultStore 

type VaultStore struct {
	// contains filtered or unexported fields
}

VaultStore is an implementation of the store.Store interface for HashiCorp Vault (KV v2).

func (*VaultStore) Delete 

func (s *VaultStore) Delete(stack string, component string, key string) error

Delete removes a KV v2 secret at the computed path.

func (*VaultStore) Get 

func (s *VaultStore) Get(stack string, component string, key string) (any, error)

Get reads the "value" field from a KV v2 path.

func (*VaultStore) GetKey 

func (s *VaultStore) GetKey(key string) (any, error)

GetKey reads the "value" field by a raw KV path (optionally prefixed).

func (*VaultStore) Has 

func (s *VaultStore) Has(stack string, component string, key string) (bool, error)

Has reports whether a secret exists at the computed path. It checks existence via the KV v2 metadata endpoint (secret/metadata/<path>) so the secret data is never read or decrypted.

func (*VaultStore) Keys 

func (s *VaultStore) Keys(stack string, component string) ([]string, error)

Keys lists the keys under a stack/component scope (or globally when both are empty), via Vault KV v2's LIST operation. Vault's LIST is directory-scoped: it returns only the immediate children of the given path, which maps naturally onto Atmos's hierarchical stack/component/key paths (unlike a flat prefix match).

func (*VaultStore) Set 

func (s *VaultStore) Set(stack string, component string, key string, value any) error

Set writes the value to a KV v2 path under a single "value" field.

func (*VaultStore) SetAuthContext 

func (s *VaultStore) SetAuthContext(resolver store.AuthContextResolver, identityName string)

SetAuthContext implements store.IdentityAwareStore. Vault token auth needs no resolver, but the hook is kept for future cloud auth methods.

type VaultStoreOptions 

type VaultStoreOptions struct {
	URL            string  `mapstructure:"url"`
	Address        string  `mapstructure:"address"`
	Token          string  `mapstructure:"token"`
	Mount          string  `mapstructure:"mount"`
	Path           string  `mapstructure:"path"`
	Prefix         *string `mapstructure:"prefix"`
	StackDelimiter *string `mapstructure:"stack_delimiter"`
}

VaultStoreOptions configures a HashiCorp Vault store.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.