Documentation
¶
Index ¶
- Constants
- Variables
- func DecryptBytes(ciphertext []byte, key []byte) ([]byte, error)
- func DecryptToken(ciphertext []byte, key []byte) (string, error)
- func EncryptBytes(plaintext []byte, key []byte) ([]byte, error)
- func EncryptToken(plaintext string, key []byte) ([]byte, error)
- func ExtractRequiredSecrets(manifestJSON []byte) (map[string]bool, error)
- func RedactSecretValues(msg string, secrets map[string]string) string
- func SecretKeyNames(secrets map[string]string) []string
- func ValidateSecrets(manifestJSON []byte, secrets map[string]string) error
- type VMCredentials
Constants ¶
const ( MaxSecretKeys = 256 MaxSecretKeyLength = 256 MaxSecretValueSize = 65536 // 64 KB per value MaxSecretsTotalSize = 1048576 // 1 MB aggregate )
Secrets validation limits.
Variables ¶
var ErrSecretsValidation = errors.New("secrets validation failed")
ErrSecretsValidation is returned when the provided secrets fail validation against the manifest or size constraints.
Functions ¶
func DecryptBytes ¶
DecryptBytes is the inverse of EncryptBytes.
func DecryptToken ¶
DecryptToken decrypts an AES-256-GCM ciphertext (with prepended nonce) back to a plaintext token. The key must be exactly 32 bytes.
func EncryptBytes ¶
EncryptBytes encrypts an arbitrary byte payload (e.g. a JSON-encoded secret map) using AES-256-GCM. It is the byte-oriented sibling of EncryptToken: same algorithm, same key requirements, same wire format (nonce || ciphertext || tag), but the caller doesn't have to pretend their bytes are UTF-8 to use it.
func EncryptToken ¶
EncryptToken encrypts a plaintext token using AES-256-GCM. The key must be exactly 32 bytes. The returned ciphertext has the nonce prepended (first 12 bytes).
func ExtractRequiredSecrets ¶
ExtractRequiredSecrets parses a compiled manifest JSON and returns the set of secret names referenced by services via env vars.
func RedactSecretValues ¶
RedactSecretValues replaces occurrences of secret values in msg with [REDACTED]. Only redacts values of 8+ characters to avoid false positives on short strings. Processes longest values first to prevent partial matches.
func SecretKeyNames ¶
SecretKeyNames returns sorted key names from a secrets map. Used for audit logging — never log values.
Types ¶
type VMCredentials ¶
type VMCredentials struct {
AuthToken string // hex-encoded random 32 bytes (64 chars)
CertPEM []byte // PEM-encoded self-signed X.509 certificate
KeyPEM []byte // PEM-encoded ECDSA private key
}
VMCredentials holds the plaintext materials generated for a single VM.
func GenerateVMCredentials ¶
func GenerateVMCredentials(vmName string) (*VMCredentials, error)
GenerateVMCredentials creates a random auth token and a self-signed TLS certificate+key pair for a single VM. The cert uses the VM name as CN, includes 127.0.0.1 and 0.0.0.0 as SANs, and expires in 7 days.
Source Files