Documentation
¶
Overview ¶
Package vault defines the installer vault interface and backend factory.
Index ¶
- Constants
- func ValidateConfiguration(vaultType Type, ageKey string) error
- type Options
- type Type
- type Vault
- type VaultSecretCreator
- func (v *VaultSecretCreator) CreateSecretFromFile(ctx context.Context, vaultFile, ageKeyPath, namespace, secretName string) error
- func (v *VaultSecretCreator) CreateSecretFromStore(ctx context.Context, store Vault, namespace, secretName string) error
- func (v *VaultSecretCreator) CreateSecretFromVault(ctx context.Context, vault *files.InstallVault, namespace, secretName string) error
- type VaultTemplatingSecretStore
- func NewLazyVaultTemplatingSecretStore(vaultPath, ageKeyPath string) *VaultTemplatingSecretStore
- func NewLazyVaultTemplatingSecretStoreWithVault(backend Vault) *VaultTemplatingSecretStore
- func NewVaultTemplatingSecretStore(vault *files.InstallVault) *VaultTemplatingSecretStore
- func NewVaultTemplatingSecretStoreFromFile(vaultPath, ageKeyPath string) (*VaultTemplatingSecretStore, error)
Constants ¶
const ( VaultSecretNamespace = "codesphere" VaultSecretName = "cs-vault" )
Variables ¶
This section is empty.
Functions ¶
func ValidateConfiguration ¶ added in v1.324.0
ValidateConfiguration validates backend-specific, non-resource parameters. File paths are intentionally validated by the file-backed constructors.
Types ¶
type Options ¶ added in v1.324.0
Options contains the parameters currently accepted by the vault factory. The factory only forwards file parameters to implementations that use them; future non-file vaults can ignore Path and WithComments entirely.
type Type ¶ added in v1.324.0
type Type string
Type identifies the on-disk vault format.
Supported Vault types
type Vault ¶ added in v1.324.0
type Vault interface {
Load() (*files.InstallVault, error)
LoadOrCreate() (*files.InstallVault, error)
Save(*files.InstallVault) error
}
Vault is the persistence boundary for installer secrets. Callers work with InstallVault values and do not need to know how those values are represented or protected on disk.
type VaultSecretCreator ¶
type VaultSecretCreator struct {
// contains filtered or unexported fields
}
func NewVaultSecretCreator ¶
func NewVaultSecretCreator(c client.Client) *VaultSecretCreator
func (*VaultSecretCreator) CreateSecretFromFile ¶
func (v *VaultSecretCreator) CreateSecretFromFile(ctx context.Context, vaultFile, ageKeyPath, namespace, secretName string) error
CreateSecretFromFile decrypts a SOPS-encrypted vault file and creates or updates a Kubernetes secret with its contents in the target cluster.
Each vault entry is mapped to one or more secret keys:
- File entries produce a single key equal to the entry name.
- Field entries produce "entryName.password" and, when present, "entryName.username".
func (*VaultSecretCreator) CreateSecretFromStore ¶ added in v1.324.0
func (v *VaultSecretCreator) CreateSecretFromStore(ctx context.Context, store Vault, namespace, secretName string) error
CreateSecretFromStore loads secrets through the abstract vault and syncs them to a Kubernetes secret.
func (*VaultSecretCreator) CreateSecretFromVault ¶
func (v *VaultSecretCreator) CreateSecretFromVault(ctx context.Context, vault *files.InstallVault, namespace, secretName string) error
CreateSecretFromVault creates or updates a Kubernetes secret with the contents of a Vault in the target cluster.
Each vault entry is mapped to one or more secret keys:
- File entries produce a single key equal to the entry name.
- Field entries produce "entryName.password" and, when present, "entryName.username".
type VaultTemplatingSecretStore ¶
type VaultTemplatingSecretStore struct {
// contains filtered or unexported fields
}
VaultTemplatingSecretStore resolves secrets referenced from config templates against a SOPS-encrypted install vault. The vault can either be provided directly or loaded lazily from disk on first lookup.
func NewLazyVaultTemplatingSecretStore ¶
func NewLazyVaultTemplatingSecretStore(vaultPath, ageKeyPath string) *VaultTemplatingSecretStore
NewLazyVaultTemplatingSecretStore returns a store that decrypts and loads the vault from vaultPath using ageKeyPath on the first secret lookup.
func NewLazyVaultTemplatingSecretStoreWithVault ¶ added in v1.324.0
func NewLazyVaultTemplatingSecretStoreWithVault(backend Vault) *VaultTemplatingSecretStore
NewLazyVaultTemplatingSecretStoreWithVault returns a lazily loaded secret store backed by any Vault implementation.
func NewVaultTemplatingSecretStore ¶
func NewVaultTemplatingSecretStore(vault *files.InstallVault) *VaultTemplatingSecretStore
NewVaultTemplatingSecretStore returns a store backed by an already-decrypted vault.
func NewVaultTemplatingSecretStoreFromFile ¶
func NewVaultTemplatingSecretStoreFromFile(vaultPath, ageKeyPath string) (*VaultTemplatingSecretStore, error)
NewVaultTemplatingSecretStoreFromFile decrypts and loads the vault from vaultPath using ageKeyPath and returns a store backed by it.
func (*VaultTemplatingSecretStore) LookupSecret ¶
func (s *VaultTemplatingSecretStore) LookupSecret(name string, selector ...string) (string, error)
LookupSecret returns the value of the named secret, optionally narrowed by a field selector (e.g. "password", "file.content"). The vault is loaded lazily on first use when the store was created without a preloaded vault.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
filebackend
Package filebackend contains implementation details shared by file-backed vaults.
|
Package filebackend contains implementation details shared by file-backed vaults. |
|
Package plain implements an unencrypted file-backed vault.
|
Package plain implements an unencrypted file-backed vault. |
|
Package sops implements a SOPS-encrypted, age-backed vault.
|
Package sops implements a SOPS-encrypted, age-backed vault. |