Documentation
¶
Index ¶
- Constants
- type ClientOptions
- type CredentialJSON
- type DialOptions
- type MasterKey
- func (key *MasterKey) Decrypt() ([]byte, error)
- func (key *MasterKey) DecryptContext(ctx context.Context) ([]byte, error)
- func (key *MasterKey) Encrypt(dataKey []byte) error
- func (key *MasterKey) EncryptContext(ctx context.Context, dataKey []byte) error
- func (key *MasterKey) EncryptIfNeeded(dataKey []byte) error
- func (key *MasterKey) EncryptedDataKey() []byte
- func (key *MasterKey) NeedsRotation() bool
- func (key *MasterKey) SetEncryptedDataKey(enc []byte)
- func (key MasterKey) ToMap() map[string]interface{}
- func (key *MasterKey) ToString() string
- func (key *MasterKey) TypeToIdentifier() string
- type TokenSource
- type UseRESTClient
Constants ¶
const ( // SopsGoogleCredentialsEnv can be set as an environment variable as either // a path to a credentials file, or directly as the variable's value in JSON // format. SopsGoogleCredentialsEnv = "GOOGLE_CREDENTIALS" // SopsGoogleCredentialsOAuthTokenEnv is the environment variable used for the // GCP OAuth 2.0 Token. SopsGoogleCredentialsOAuthTokenEnv = "GOOGLE_OAUTH_ACCESS_TOKEN" // SopsGCPKMSClientTypeEnv is the environment variable used to specify the // GCP KMS client type. Valid values are "grpc" (default) and "rest". SopsGCPKMSClientTypeEnv = "SOPS_GCP_KMS_CLIENT_TYPE" // SopsGCPKMSEndpointEnv overrides the GCP KMS endpoint URL. Useful for // sovereign cloud environments that expose a GCP-compatible KMS API at a // non-standard endpoint (e.g. S3NS/Thales TPC: cloudkms.s3nsapis.fr). SopsGCPKMSEndpointEnv = "SOPS_GCP_KMS_ENDPOINT" // SopsGCPKMSUniverseDomainEnv sets the universe domain for the GCP KMS // client, which derives the endpoint as cloudkms.{UNIVERSE_DOMAIN}:443. // Example: "s3nsapis.fr" for S3NS/Thales TPC. SopsGCPKMSUniverseDomainEnv = "SOPS_GCP_KMS_UNIVERSE_DOMAIN" // KeyTypeIdentifier is the string used to identify a GCP KMS MasterKey. KeyTypeIdentifier = "gcp_kms" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ClientOptions ¶ added in v3.12.0
type ClientOptions []option.ClientOption
ClientOptions are the client options used to create the GCP KMS client.
func (ClientOptions) ApplyToMasterKey ¶ added in v3.12.0
func (c ClientOptions) ApplyToMasterKey(key *MasterKey)
ApplyToMasterKey configures the ClientOptions on the provided key.
type CredentialJSON ¶
type CredentialJSON []byte
CredentialJSON is the Service Account credentials JSON used for authenticating towards the GCP KMS service.
func (CredentialJSON) ApplyToMasterKey ¶
func (c CredentialJSON) ApplyToMasterKey(key *MasterKey)
ApplyToMasterKey configures the CredentialJSON on the provided key.
type DialOptions ¶ added in v3.11.0
type DialOptions []grpc.DialOption
DialOptions are the gRPC dial options used to create the gRPC connection.
func (DialOptions) ApplyToMasterKey ¶ added in v3.11.0
func (d DialOptions) ApplyToMasterKey(key *MasterKey)
ApplyToMasterKey configures the DialOptions on the provided key.
type MasterKey ¶
type MasterKey struct {
// ResourceID is the resource id used to refer to the gcp kms key.
// It can be retrieved using the `gcloud` command.
ResourceID string
// EncryptedKey is the string returned after encrypting with GCP KMS.
EncryptedKey string
// CreationDate is the creation timestamp of the MasterKey. Used
// for NeedsRotation.
CreationDate time.Time
// contains filtered or unexported fields
}
MasterKey is a GCP KMS key used to encrypt and decrypt the SOPS data key.
func MasterKeysFromResourceIDString ¶
MasterKeysFromResourceIDString takes a comma separated list of GCP KMS resource IDs and returns a slice of new MasterKeys for them.
func NewMasterKeyFromResourceID ¶
NewMasterKeyFromResourceID creates a new MasterKey with the provided resource ID.
func (*MasterKey) Decrypt ¶
Decrypt decrypts the EncryptedKey field with GCP KMS and returns the result.
Consider using DecryptContext instead.
func (*MasterKey) DecryptContext ¶ added in v3.11.0
DecryptContext decrypts the EncryptedKey field with GCP KMS and returns the result.
func (*MasterKey) Encrypt ¶
Encrypt takes a SOPS data key, encrypts it with GCP KMS, and stores the result in the EncryptedKey field.
Consider using EncryptContext instead.
func (*MasterKey) EncryptContext ¶ added in v3.11.0
EncryptContext takes a SOPS data key, encrypts it with GCP KMS, and stores the result in the EncryptedKey field.
func (*MasterKey) EncryptIfNeeded ¶
EncryptIfNeeded encrypts the provided SOPS data key, if it has not been encrypted yet.
func (*MasterKey) EncryptedDataKey ¶
EncryptedDataKey returns the encrypted data key this master key holds.
func (*MasterKey) NeedsRotation ¶
NeedsRotation returns whether the data key needs to be rotated or not.
func (*MasterKey) SetEncryptedDataKey ¶
SetEncryptedDataKey sets the encrypted data key for this master key.
func (*MasterKey) TypeToIdentifier ¶ added in v3.9.0
TypeToIdentifier returns the string identifier for the MasterKey type.
type TokenSource ¶ added in v3.10.0
type TokenSource struct {
// contains filtered or unexported fields
}
TokenSource is an oauth2.TokenSource used for authenticating towards the GCP KMS service.
func NewTokenSource ¶ added in v3.10.0
func NewTokenSource(source oauth2.TokenSource) TokenSource
NewTokenSource creates a new TokenSource from the provided oauth2.TokenSource.
func (TokenSource) ApplyToMasterKey ¶ added in v3.10.0
func (t TokenSource) ApplyToMasterKey(key *MasterKey)
ApplyToMasterKey configures the TokenSource on the provided key.
type UseRESTClient ¶ added in v3.12.0
type UseRESTClient struct{}
UseRESTClient configures the MasterKey to use the REST client for GCP KMS.
func (UseRESTClient) ApplyToMasterKey ¶ added in v3.12.0
func (UseRESTClient) ApplyToMasterKey(key *MasterKey)
ApplyToMasterKey configures the MasterKey to use the REST client for GCP KMS.
Source Files