Documentation
¶
Overview ¶
Package secrets keeps secret values encrypted at rest and fetches secrets from external managers such as Infisical, Vault, Doppler and 1Password.
Index ¶
- Constants
- Variables
- func CheckFields(fields []Field, values map[string]string) error
- func IsSealed(value string) bool
- type Binding
- type Connections
- type Doppler
- type Field
- type Generator
- type Infisical
- type Keyring
- type OnePassword
- type Provider
- type Registry
- type Resolver
- type Rotation
- type Scope
- type ScopeType
- type Secret
- type Store
- func (s *Store) AddBinding(b Binding) (*Binding, error)
- func (s *Store) Binding(id string) (*Binding, error)
- func (s *Store) Bindings(scope Scope) ([]Binding, error)
- func (s *Store) ConnectionInUse(connectionID string) (bool, error)
- func (s *Store) Delete(scope Scope, name string) error
- func (s *Store) DeleteBinding(id string) error
- func (s *Store) DropScope(scope Scope) error
- func (s *Store) Get(scope Scope, name string) (*Secret, error)
- func (s *Store) List(scope Scope) ([]Secret, error)
- func (s *Store) Rotate(scope Scope, name string) (*Secret, error)
- func (s *Store) Rotating() ([]Secret, error)
- func (s *Store) Set(scope Scope, name, value string) (*Secret, error)
- func (s *Store) SetRotation(scope Scope, name string, rotation *Rotation) (*Secret, error)
- func (s *Store) Values(scope Scope) (map[string]string, error)
- type Vault
Constants ¶
const ( CharsetAlphanumeric = "alphanumeric" CharsetHex = "hex" CharsetSymbols = "symbols" )
const ReferenceName = "secret"
ReferenceName is the reference target that reads secrets, as in ${{ secret.DB_PASSWORD }}.
Variables ¶
var ( ErrNotFound = errors.New("secret not found") ErrInvalidName = errors.New("secret names use letters, digits and underscores, and do not start with a digit") )
var ErrNotSealed = errors.New("value is not sealed")
Functions ¶
func CheckFields ¶
CheckFields reports the first required field missing from values.
Types ¶
type Binding ¶
type Binding struct {
ID string `json:"id"`
Scope Scope `json:"scope"`
Provider string `json:"provider"`
ConnectionID string `json:"connection_id"`
Options map[string]string `json:"options,omitempty"`
CreatedAt time.Time `json:"created_at"`
}
Binding connects a scope to a secret manager. Every key the manager returns becomes readable as ${{ secret.KEY }} in that scope.
type Connections ¶
Connections looks up the stored settings of a provider connection.
type Doppler ¶
Doppler downloads a config's secrets. A service token already names its project and config, so those are only needed with other token types.
func (Doppler) BindingFields ¶
func (Doppler) ConnectionFields ¶
type Field ¶
type Field struct {
Key string `json:"key"`
Label string `json:"label"`
Secret bool `json:"secret,omitempty"`
Required bool `json:"required,omitempty"`
Default string `json:"default,omitempty"`
}
Field describes one setting a provider needs, either on its connection (credentials) or on a binding (where to read from).
type Infisical ¶
Infisical reads one folder of a project environment with a machine identity's universal auth credentials.
func (Infisical) BindingFields ¶
func (Infisical) ConnectionFields ¶
type Keyring ¶
type Keyring struct {
// contains filtered or unexported fields
}
Keyring seals values with AES-256-GCM under a key kept in its own file.
func LoadKeyring ¶
LoadKeyring reads the key at path, creating a new random key when the file does not exist.
func NewKeyring ¶
type OnePassword ¶
OnePassword reads one item's fields through a 1Password Connect server. Each field's label becomes a key.
func (OnePassword) BindingFields ¶
func (OnePassword) BindingFields() []Field
func (OnePassword) ConnectionFields ¶
func (OnePassword) ConnectionFields() []Field
func (OnePassword) Label ¶
func (OnePassword) Label() string
func (OnePassword) Type ¶
func (OnePassword) Type() string
type Provider ¶
type Provider interface {
Type() string
Label() string
ConnectionFields() []Field
BindingFields() []Field
Fetch(ctx context.Context, credentials, options map[string]string) (map[string]string, error)
}
Provider reads secrets from an external manager. Credentials hold the connection's settings; options say which secrets the binding reads.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
func DefaultRegistry ¶
DefaultRegistry holds every built-in provider.
func NewRegistry ¶
type Resolver ¶
type Resolver struct {
Store *Store
Registry *Registry
Connections Connections
}
Resolver merges stored secrets with what bound managers return.
func (Resolver) FetchBinding ¶
FetchBinding reads every key a binding's manager returns.
type Scope ¶
Scope is what a secret or binding belongs to. A service scope is written as deployment/service.
func ParseScope ¶
func (Scope) Deployment ¶
Deployment is the deployment a deployment or service scope belongs to.
type Secret ¶
type Secret struct {
Name string `json:"name"`
Scope Scope `json:"scope"`
Version int `json:"version"`
Rotation *Rotation `json:"rotation,omitempty"`
LastRotatedAt *time.Time `json:"last_rotated_at,omitempty"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
Secret is a stored secret without its value. Values only leave the store through Value.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store keeps secrets and bindings in one JSON file, with every value sealed by the keyring.
func (*Store) ConnectionInUse ¶
ConnectionInUse reports whether any binding uses a connection.
func (*Store) DeleteBinding ¶
func (*Store) DropScope ¶
DropScope removes every secret and binding of a scope, for a deleted deployment or workspace.
func (*Store) Rotate ¶
Rotate replaces a secret's value with a generated one, using its rotation settings or the default generator.
func (*Store) SetRotation ¶
SetRotation sets or clears how a secret rotates.
type Vault ¶
Vault reads one secret from a KV version 2 engine. OpenBao serves the same API.
Source Files