secrets

package
v0.0.1-dev.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 10, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AclItem 

type AclItem struct {
	// The principal in which the permission is applied.
	Principal *string
	// The permission level applied to the principal.
	Permission AclPermission
}

An item representing an ACL rule applied to the given principal (user or group) on the associated scope point..

type AclPermission 

type AclPermission string

The ACL permission levels for Secret ACLs applied to secret scopes. 

const (
	AclPermission_Unspecified AclPermission = ""
	// Allowed to perform read operations (get, list) on secrets in this scope.
	AclPermission_Read AclPermission = "READ"
	// Allowed to read and write secrets to this secret scope.
	AclPermission_Write AclPermission = "WRITE"
	// Allowed to read/write ACLs, and read/write secrets to this secret scope.
	AclPermission_Manage AclPermission = "MANAGE"
)

type AzureKeyVaultSecretScopeMetadata 

type AzureKeyVaultSecretScopeMetadata struct {
	// The resource id of the azure KeyVault that user wants to associate the scope
	// with.
	ResourceId *string
	// The DNS of the KeyVault
	DnsName *string
}

The metadata of the Azure KeyVault for a secret scope of type `AZURE_KEYVAULT`.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

func NewClient 

func NewClient(ctx context.Context, opts ...client.Option) (*Client, error)

func (*Client) CreateScope 

func (c *Client) CreateScope(ctx context.Context, req CreateScopeRequest, opts ...call.Option) (*CreateScopeResponse, error)

Creates a new secret scope.

The scope name must consist of alphanumeric characters, dashes, underscores, and periods, and may not exceed 128 characters.

Example request:

.. code::

{ "scope": "my-simple-databricks-scope", "initial_manage_principal": "users" "scope_backend_type": "databricks|azure_keyvault", # below is only required if scope type is azure_keyvault "backend_azure_keyvault": { "resource_id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xxxx/providers/Microsoft.KeyVault/vaults/xxxx", "tenant_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "dns_name": "https://xxxx.vault.azure.net/", } }

If “initial_manage_principal“ is specified, the initial ACL applied to the scope is applied to the supplied principal (user or group) with “MANAGE“ permissions. The only supported principal for this option is the group “users“, which contains all users in the workspace. If “initial_manage_principal“ is not specified, the initial ACL with “MANAGE“ permission applied to the scope is assigned to the API request issuer's user identity.

If “scope_backend_type“ is “azure_keyvault“, a secret scope is created with secrets from a given Azure KeyVault. The caller must provide the keyvault_resource_id and the tenant_id for the key vault. If “scope_backend_type“ is “databricks“ or is unspecified, an empty secret scope is created and stored in <Databricks>'s own storage.

Throws “RESOURCE_ALREADY_EXISTS“ if a scope with the given name already exists. Throws “RESOURCE_LIMIT_EXCEEDED“ if maximum number of scopes in the workspace is exceeded. Throws “INVALID_PARAMETER_VALUE“ if the scope name is invalid. Throws “BAD_REQUEST“ if request violated constraints. Throws “CUSTOMER_UNAUTHORIZED“ if normal user attempts to create a scope with name reserved for databricks internal usage. Throws “UNAUTHENTICATED“ if unable to verify user access permission on Azure KeyVault

func (*Client) DeleteAcl 

func (c *Client) DeleteAcl(ctx context.Context, req DeleteAclRequest, opts ...call.Option) (*DeleteAclResponse, error)

Deletes the given ACL on the given scope.

Users must have the “MANAGE“ permission to invoke this API.

Example request:

.. code::

{ "scope": "my-secret-scope", "principal": "data-scientists" }

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope, principal, or ACL exists. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call. Throws “INVALID_PARAMETER_VALUE“ if the permission or principal is invalid.

func (*Client) DeleteScope 

func (c *Client) DeleteScope(ctx context.Context, req DeleteScopeRequest, opts ...call.Option) (*DeleteScopeResponse, error)

Deletes a secret scope.

Example request:

.. code::

{ "scope": "my-secret-scope" }

Throws “RESOURCE_DOES_NOT_EXIST“ if the scope does not exist. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call. Throws “BAD_REQUEST“ if system user attempts to delete internal secret scope.

func (*Client) DeleteSecret 

func (c *Client) DeleteSecret(ctx context.Context, req DeleteSecretRequest, opts ...call.Option) (*DeleteSecretResponse, error)

Deletes the secret stored in this secret scope. You must have “WRITE“ or “MANAGE“ permission on the Secret Scope.

Example request:

.. code::

{ "scope": "my-secret-scope", "key": "my-secret-key" }

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope or secret exists. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call. Throws “BAD_REQUEST“ if system user attempts to delete an internal secret, or request is made against Azure KeyVault backed scope.

func (*Client) GetAcl 

func (c *Client) GetAcl(ctx context.Context, req GetAclRequest, opts ...call.Option) (*AclItem, error)

Describes the details about the given ACL, such as the group and permission.

Users must have the “MANAGE“ permission to invoke this API.

Example response:

.. code::

{ "principal": "data-scientists", "permission": "READ" }

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope exists. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call. Throws “INVALID_PARAMETER_VALUE“ if the permission or principal is invalid.

func (*Client) GetSecret 

func (c *Client) GetSecret(ctx context.Context, req GetSecretRequest, opts ...call.Option) (*GetSecretResponse, error)

Gets a secret for a given key and scope. This API can only be called from the DBUtils interface. Users need the READ permission to make this call.

Example response:

.. code::

{ "key": "my-string-key", "value": <bytes of the secret value> }

Note that the secret value returned is in bytes. The interpretation of the bytes is determined by the caller in DBUtils and the type the data is decoded into.

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret or secret scope exists. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call.

Note: This is explicitly an undocumented API. It also doesn't need to be supported for the /preview prefix, because it's not a customer-facing API (i.e. only used for DBUtils SecretUtils to fetch secrets).

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope or secret exists. Throws “BAD_REQUEST“ if normal user calls get secret outside of a notebook. AKV specific errors: Throws “INVALID_PARAMETER_VALUE“ if secret name is not alphanumeric or too long. Throws “PERMISSION_DENIED“ if secret manager cannot access AKV with 403 error Throws “MALFORMED_REQUEST“ if secret manager cannot access AKV with any other 4xx error

func (*Client) ListAcls 

func (c *Client) ListAcls(ctx context.Context, req ListAclsRequest, opts ...call.Option) (*ListAclsResponse, error)

Lists the ACLs set on the given scope.

Users must have the “MANAGE“ permission to invoke this API.

Example response:

.. code::

{ "acls": [{ "principal": "admins", "permission": "MANAGE" },{ "principal": "data-scientists", "permission": "READ" }] }

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope exists. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call.

func (*Client) ListScopes 

func (c *Client) ListScopes(ctx context.Context, req ListScopesRequest, opts ...call.Option) (*ListScopesResponse, error)

Lists all secret scopes available in the workspace.

Example response:

.. code::

{ "scopes": [{ "name": "my-databricks-scope", "backend_type": "DATABRICKS" },{ "name": "mount-points", "backend_type": "DATABRICKS" }] }

Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call.

func (*Client) ListSecrets 

func (c *Client) ListSecrets(ctx context.Context, req ListSecretsRequest, opts ...call.Option) (*ListSecretsResponse, error)

Lists the secret keys that are stored at this scope. This is a metadata-only operation; secret data cannot be retrieved using this API. Users need the READ permission to make this call.

Example response:

.. code::

{ "secrets": [ { "key": "my-string-key"", "last_updated_timestamp": "1520467595000" }, { "key": "my-byte-key", "last_updated_timestamp": "1520467595000" }, ] }

The lastUpdatedTimestamp returned is in milliseconds since epoch.

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope exists. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call.

func (*Client) PutAcl 

func (c *Client) PutAcl(ctx context.Context, req PutAclRequest, opts ...call.Option) (*PutAclResponse, error)

Creates or overwrites the ACL associated with the given principal (user or group) on the specified scope point. In general, a user or group will use the most powerful permission available to them, and permissions are ordered as follows:

* “MANAGE“ - Allowed to change ACLs, and read and write to this secret scope. * “WRITE“ - Allowed to read and write to this secret scope. * “READ“ - Allowed to read this secret scope and list what secrets are available.

Note that in general, secret values can only be read from within a command on a cluster (for example, through a notebook). There is no API to read the actual secret value material outside of a cluster. However, the user's permission will be applied based on who is executing the command, and they must have at least READ permission.

Users must have the “MANAGE“ permission to invoke this API.

Example request:

.. code::

{ "scope": "my-secret-scope", "principal": "data-scientists", "permission": "READ" }

The principal is a user or group name corresponding to an existing <Databricks> principal to be granted or revoked access.

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope exists. Throws “RESOURCE_ALREADY_EXISTS“ if a permission for the principal already exists. Throws “INVALID_PARAMETER_VALUE“ if the permission or principal is invalid. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call.

func (*Client) PutSecret 

func (c *Client) PutSecret(ctx context.Context, req PutSecretRequest, opts ...call.Option) (*PutSecretResponse, error)

Inserts a secret under the provided scope with the given name. If a secret already exists with the same name, this command overwrites the existing secret's value. The server encrypts the secret using the secret scope's encryption settings before storing it. You must have “WRITE“ or “MANAGE“ permission on the secret scope.

The secret key must consist of alphanumeric characters, dashes, underscores, and periods, and cannot exceed 128 characters. The maximum allowed secret value size is 128 KB. The maximum number of secrets in a given scope is 1000.

Example request:

.. code::

{ "scope": "my-databricks-scope", "key": "my-string-key", "string_value": "foobar" }

The input fields "string_value" or "bytes_value" specify the type of the secret, which will determine the value returned when the secret value is requested. Exactly one must be specified.

Throws “RESOURCE_DOES_NOT_EXIST“ if no such secret scope exists. Throws “RESOURCE_LIMIT_EXCEEDED“ if maximum number of secrets in scope is exceeded. Throws “INVALID_PARAMETER_VALUE“ if the request parameters are invalid. Throws “PERMISSION_DENIED“ if the user does not have permission to make this API call. Throws “MALFORMED_REQUEST“ if request is incorrectly formatted or conflicting. Throws “BAD_REQUEST“ if request is made against Azure KeyVault backed scope.

type CreateScopeRequest 

type CreateScopeRequest struct {
	// Scope name requested by the user. Scope names are unique.
	Scope *string
	// The principal that is initially granted “MANAGE“ permission to the created
	// scope.
	InitialManagePrincipal *string
	// The backend type the scope will be created with. If not specified, will
	// default to “DATABRICKS“
	ScopeBackendType ScopeBackendType
	// The metadata for the secret scope if the type is “AZURE_KEYVAULT“
	BackendAzureKeyvault *AzureKeyVaultSecretScopeMetadata
}

type CreateScopeResponse 

type CreateScopeResponse struct {
}

type DeleteAclRequest 

type DeleteAclRequest struct {
	// The name of the scope to remove permissions from.
	Scope *string
	// The principal to remove an existing ACL from.
	Principal *string
}

type DeleteAclResponse 

type DeleteAclResponse struct {
}

type DeleteScopeRequest 

type DeleteScopeRequest struct {
	// Name of the scope to delete.
	Scope *string
}

type DeleteScopeResponse 

type DeleteScopeResponse struct {
}

type DeleteSecretRequest 

type DeleteSecretRequest struct {
	// The name of the scope that contains the secret to delete.
	Scope *string
	// Name of the secret to delete.
	Key *string
}

type DeleteSecretResponse 

type DeleteSecretResponse struct {
}

type GetAclRequest 

type GetAclRequest struct {
	// The name of the scope to fetch ACL information from.
	Scope *string
	// The principal to fetch ACL information for.
	Principal *string
}

type GetSecretRequest 

type GetSecretRequest struct {
	// The name of the scope that contains the secret.
	Scope *string
	// Name of the secret to fetch value information.
	Key *string
}

type GetSecretResponse 

type GetSecretResponse struct {
	// A unique name to identify the secret.
	Key *string
	// The value of the secret in its byte representation.
	Value []byte
}

type ListAclsRequest 

type ListAclsRequest struct {
	// The name of the scope to fetch ACL information from.
	Scope *string
}

type ListAclsResponse 

type ListAclsResponse struct {
	// The associated ACLs rule applied to principals in the given scope.
	Items []AclItem
}

type ListScopesRequest 

type ListScopesRequest struct {
}

type ListScopesResponse 

type ListScopesResponse struct {
	// The available secret scopes.
	Scopes []SecretScope
}

type ListSecretsRequest 

type ListSecretsRequest struct {
	// The name of the scope to list secrets within.
	Scope *string
}

type ListSecretsResponse 

type ListSecretsResponse struct {
	// Metadata information of all secrets contained within the given scope.
	Secrets []SecretMetadata
}

type PutAclRequest 

type PutAclRequest struct {
	// The name of the scope to apply permissions to.
	Scope *string
	// The principal in which the permission is applied.
	Principal *string
	// The permission level applied to the principal.
	Permission AclPermission
}

type PutAclResponse 

type PutAclResponse struct {
}

type PutSecretRequest 

type PutSecretRequest struct {
	// The name of the scope to which the secret will be associated with.
	Scope *string
	// A unique name to identify the secret.
	Key   *string
	Value isPutSecretRequest_Value
}

type PutSecretRequest_Value_BytesValue 

type PutSecretRequest_Value_BytesValue struct {
	BytesValue []byte
}

PutSecretRequest_Value_BytesValue selects BytesValue for PutSecretRequest.Value. If specified, value will be stored as bytes.

type PutSecretRequest_Value_StringValue 

type PutSecretRequest_Value_StringValue struct {
	StringValue string
}

PutSecretRequest_Value_StringValue selects StringValue for PutSecretRequest.Value. If specified, note that the value will be stored in UTF-8 (MB4) form.

type PutSecretResponse 

type PutSecretResponse struct {
}

type ScopeBackendType 

type ScopeBackendType string

The types of secret scope backends in the Secret Manager. Azure KeyVault backed secret scopes will be supported in a later release. 

const (
	ScopeBackendType_Unspecified ScopeBackendType = ""
	// A secret scope in which secrets are stored in Databrick managed storage and
	// encrypted with a cloud-based specific encryption key.
	ScopeBackendType_Databricks ScopeBackendType = "DATABRICKS"
	// A customer Azure KeyVault backed secret scope. Reading secrets from this
	// scope will directly read secrets from the customer vault. Only scope and
	// secret ACL metadata are stored in Databricks.
	ScopeBackendType_AzureKeyvault ScopeBackendType = "AZURE_KEYVAULT"
)

type SecretMetadata 

type SecretMetadata struct {
	// A unique name to identify the secret.
	Key *string
	// The last updated timestamp (in milliseconds) for the secret.
	LastUpdatedTimestamp *int64
}

The metadata about a secret. Returned when listing secrets. Does not contain the actual secret value..

type SecretScope 

type SecretScope struct {
	// A unique name to identify the secret scope.
	Name *string
	// The type of secret scope backend.
	BackendType ScopeBackendType
	// The metadata for the secret scope if the type is “AZURE_KEYVAULT“
	KeyvaultMetadata *AzureKeyVaultSecretScopeMetadata
}

An organizational resource for storing secrets. Secret scopes can be different types (Databricks-managed, Azure KeyVault backed, etc), and ACLs can be applied to control permissions for all secrets within a scope..

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.