Documentation
¶
Index ¶
- Constants
- func DecryptFileWithSOPS(src, keyPath string) ([]byte, error)
- func EncryptFileWithSOPS(src, target, recipient string) error
- func IsSOPSEncryptedFile(path string) (bool, error)
- func LoadUnencryptedVaultData(vaultPath string) (*files.InstallVault, error)
- func LoadVaultData(vaultPath, ageKeyPath string) (*files.InstallVault, error)
- func ResolveAgeKey(explicitKeyFile, fallbackDir string) (recipient string, keyPath string, err error)
- type AgeKeyResolver
- type DefaultAgeKeyResolver
- type Encryptor
- type MockAgeKeyResolver
- type MockAgeKeyResolver_Expecter
- type MockAgeKeyResolver_Resolve_Call
- func (_c *MockAgeKeyResolver_Resolve_Call) Return(recipient string, keyPath string, err error) *MockAgeKeyResolver_Resolve_Call
- func (_c *MockAgeKeyResolver_Resolve_Call) Run(run func(explicitKeyFile string, fallbackDir string)) *MockAgeKeyResolver_Resolve_Call
- func (_c *MockAgeKeyResolver_Resolve_Call) RunAndReturn(run func(explicitKeyFile string, fallbackDir string) (string, string, error)) *MockAgeKeyResolver_Resolve_Call
- type MockEncryptor
- type MockEncryptor_Encrypt_Call
- func (_c *MockEncryptor_Encrypt_Call) Return(err error) *MockEncryptor_Encrypt_Call
- func (_c *MockEncryptor_Encrypt_Call) Run(run func(src string, target string, recipient string)) *MockEncryptor_Encrypt_Call
- func (_c *MockEncryptor_Encrypt_Call) RunAndReturn(run func(src string, target string, recipient string) error) *MockEncryptor_Encrypt_Call
- type MockEncryptor_Expecter
- type SOPSEncryptor
- type VaultSecretCreator
- type VaultTemplatingSecretStore
Constants ¶
const ( VaultSecretNamespace = "codesphere" VaultSecretName = "cs-vault" )
Variables ¶
This section is empty.
Functions ¶
func DecryptFileWithSOPS ¶
DecryptFileWithSOPS decrypts a SOPS-encrypted file and returns the plaintext bytes. If keyPath is non-empty, SOPS_AGE_KEY_FILE is set for the sops process.
func EncryptFileWithSOPS ¶
EncryptFileWithSOPS encrypts src with SOPS+age and writes ciphertext to target.
func IsSOPSEncryptedFile ¶
IsSOPSEncryptedFile checks whether the file at path is a SOPS-encrypted YAML document.
func LoadUnencryptedVaultData ¶ added in v1.261.1
func LoadUnencryptedVaultData(vaultPath string) (*files.InstallVault, error)
LoadUnencryptedVaultData reads parses an unencrypted vault at vaultPath returning the decoded install vault. This is only used for GCP Bootstrapping. All other features should force a decrypted vault.
func LoadVaultData ¶
func LoadVaultData(vaultPath, ageKeyPath string) (*files.InstallVault, error)
LoadVaultData reads, SOPS-decrypts, and parses the vault at vaultPath using the age key at ageKeyPath, returning the decoded install vault.
func ResolveAgeKey ¶
func ResolveAgeKey(explicitKeyFile, fallbackDir string) (recipient string, keyPath string, err error)
ResolveAgeKey resolves an existing age key or generates a new one.
When explicitKeyFile is non-empty it takes priority over everything else: the recipient is read directly from that file and it is returned as the key path. This lets callers thread an explicit --age-key-file through without mutating the process environment.
Otherwise it checks (in order):
- SOPS_AGE_KEY environment variable (raw key content)
- SOPS_AGE_KEY_FILE environment variable (path to key file)
- Default location: ~/.config/sops/age/keys.txt
- Generate a new key and write it to <fallbackDir>/age_key.txt
Returns the age public key (recipient) and the path to the key file (empty when the key was supplied via SOPS_AGE_KEY).
Types ¶
type AgeKeyResolver ¶ added in v1.284.1
type AgeKeyResolver interface {
Resolve(explicitKeyFile, fallbackDir string) (recipient, keyPath string, err error)
}
AgeKeyResolver finds the age recipient used to encrypt a vault.
type DefaultAgeKeyResolver ¶ added in v1.284.1
type DefaultAgeKeyResolver struct{}
DefaultAgeKeyResolver resolves age keys from the standard SOPS locations.
type MockAgeKeyResolver ¶ added in v1.284.1
MockAgeKeyResolver is an autogenerated mock type for the AgeKeyResolver type
func NewMockAgeKeyResolver ¶ added in v1.284.1
func NewMockAgeKeyResolver(t interface {
mock.TestingT
Cleanup(func())
}) *MockAgeKeyResolver
NewMockAgeKeyResolver creates a new instance of MockAgeKeyResolver. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. The first argument is typically a *testing.T value.
func (*MockAgeKeyResolver) EXPECT ¶ added in v1.284.1
func (_m *MockAgeKeyResolver) EXPECT() *MockAgeKeyResolver_Expecter
type MockAgeKeyResolver_Expecter ¶ added in v1.284.1
type MockAgeKeyResolver_Expecter struct {
// contains filtered or unexported fields
}
func (*MockAgeKeyResolver_Expecter) Resolve ¶ added in v1.284.1
func (_e *MockAgeKeyResolver_Expecter) Resolve(explicitKeyFile any, fallbackDir any) *MockAgeKeyResolver_Resolve_Call
Resolve is a helper method to define mock.On call
- explicitKeyFile string
- fallbackDir string
type MockAgeKeyResolver_Resolve_Call ¶ added in v1.284.1
MockAgeKeyResolver_Resolve_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Resolve'
func (*MockAgeKeyResolver_Resolve_Call) Return ¶ added in v1.284.1
func (_c *MockAgeKeyResolver_Resolve_Call) Return(recipient string, keyPath string, err error) *MockAgeKeyResolver_Resolve_Call
func (*MockAgeKeyResolver_Resolve_Call) Run ¶ added in v1.284.1
func (_c *MockAgeKeyResolver_Resolve_Call) Run(run func(explicitKeyFile string, fallbackDir string)) *MockAgeKeyResolver_Resolve_Call
func (*MockAgeKeyResolver_Resolve_Call) RunAndReturn ¶ added in v1.284.1
func (_c *MockAgeKeyResolver_Resolve_Call) RunAndReturn(run func(explicitKeyFile string, fallbackDir string) (string, string, error)) *MockAgeKeyResolver_Resolve_Call
type MockEncryptor ¶ added in v1.284.1
MockEncryptor is an autogenerated mock type for the Encryptor type
func NewMockEncryptor ¶ added in v1.284.1
func NewMockEncryptor(t interface {
mock.TestingT
Cleanup(func())
}) *MockEncryptor
NewMockEncryptor creates a new instance of MockEncryptor. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. The first argument is typically a *testing.T value.
func (*MockEncryptor) EXPECT ¶ added in v1.284.1
func (_m *MockEncryptor) EXPECT() *MockEncryptor_Expecter
type MockEncryptor_Encrypt_Call ¶ added in v1.284.1
MockEncryptor_Encrypt_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Encrypt'
func (*MockEncryptor_Encrypt_Call) Return ¶ added in v1.284.1
func (_c *MockEncryptor_Encrypt_Call) Return(err error) *MockEncryptor_Encrypt_Call
func (*MockEncryptor_Encrypt_Call) Run ¶ added in v1.284.1
func (_c *MockEncryptor_Encrypt_Call) Run(run func(src string, target string, recipient string)) *MockEncryptor_Encrypt_Call
func (*MockEncryptor_Encrypt_Call) RunAndReturn ¶ added in v1.284.1
func (_c *MockEncryptor_Encrypt_Call) RunAndReturn(run func(src string, target string, recipient string) error) *MockEncryptor_Encrypt_Call
type MockEncryptor_Expecter ¶ added in v1.284.1
type MockEncryptor_Expecter struct {
// contains filtered or unexported fields
}
func (*MockEncryptor_Expecter) Encrypt ¶ added in v1.284.1
func (_e *MockEncryptor_Expecter) Encrypt(src any, target any, recipient any) *MockEncryptor_Encrypt_Call
Encrypt is a helper method to define mock.On call
- src string
- target string
- recipient string
type SOPSEncryptor ¶ added in v1.284.1
type SOPSEncryptor struct{}
SOPSEncryptor encrypts vaults using SOPS and age.
func (SOPSEncryptor) Encrypt ¶ added in v1.284.1
func (SOPSEncryptor) Encrypt(src, target, recipient string) error
type VaultSecretCreator ¶
type VaultSecretCreator struct {
// contains filtered or unexported fields
}
func NewVaultSecretCreator ¶
func NewVaultSecretCreator(c client.Client) *VaultSecretCreator
func (*VaultSecretCreator) CreateSecretFromFile ¶
func (v *VaultSecretCreator) CreateSecretFromFile(ctx context.Context, vaultFile, ageKeyPath, namespace, secretName string) error
CreateSecretFromFile decrypts a SOPS-encrypted vault file and creates or updates a Kubernetes secret with its contents in the target cluster.
Each vault entry is mapped to one or more secret keys:
- File entries produce a single key equal to the entry name.
- Field entries produce "entryName.password" and, when present, "entryName.username".
func (*VaultSecretCreator) CreateSecretFromVault ¶
func (v *VaultSecretCreator) CreateSecretFromVault(ctx context.Context, vault *files.InstallVault, namespace, secretName string) error
CreateSecretFromVault creates or updates a Kubernetes secret with the contents of a Vault in the target cluster.
Each vault entry is mapped to one or more secret keys:
- File entries produce a single key equal to the entry name.
- Field entries produce "entryName.password" and, when present, "entryName.username".
type VaultTemplatingSecretStore ¶
type VaultTemplatingSecretStore struct {
// contains filtered or unexported fields
}
VaultTemplatingSecretStore resolves secrets referenced from config templates against a SOPS-encrypted install vault. The vault can either be provided directly or loaded lazily from disk on first lookup.
func NewLazyVaultTemplatingSecretStore ¶
func NewLazyVaultTemplatingSecretStore(vaultPath, ageKeyPath string) *VaultTemplatingSecretStore
NewLazyVaultTemplatingSecretStore returns a store that decrypts and loads the vault from vaultPath using ageKeyPath on the first secret lookup.
func NewVaultTemplatingSecretStore ¶
func NewVaultTemplatingSecretStore(vault *files.InstallVault) *VaultTemplatingSecretStore
NewVaultTemplatingSecretStore returns a store backed by an already-decrypted vault.
func NewVaultTemplatingSecretStoreFromFile ¶
func NewVaultTemplatingSecretStoreFromFile(vaultPath, ageKeyPath string) (*VaultTemplatingSecretStore, error)
NewVaultTemplatingSecretStoreFromFile decrypts and loads the vault from vaultPath using ageKeyPath and returns a store backed by it.
func (*VaultTemplatingSecretStore) LookupSecret ¶
func (s *VaultTemplatingSecretStore) LookupSecret(name string, selector ...string) (string, error)
LookupSecret returns the value of the named secret, optionally narrowed by a field selector (e.g. "password", "file.content"). The vault is loaded lazily on first use when the store was created without a preloaded vault.
Source Files