secrets

package
v1.0.0-rc.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 7, 2026 License: MIT Imports: 10 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ResolveSecret

func ResolveSecret(ctx context.Context, mgr Manager, value string) string

ResolveSecret takes a value and if it is marked as a secret (e.g. "secret:KEY" or "{{secret:KEY}}"), it attempts to resolve it using the provided manager.

Types

type AWSConfig

type AWSConfig struct {
	Region string `yaml:"region" json:"region"`
}

type AWSSecretsManager

type AWSSecretsManager struct {
	// contains filtered or unexported fields
}

AWSSecretsManager implements secrets.Manager for AWS Secrets Manager.

func NewAWSSecretsManager

func NewAWSSecretsManager(ctx context.Context, region string) (*AWSSecretsManager, error)

NewAWSSecretsManager creates a new AWSSecretsManager.

func (*AWSSecretsManager) Get

func (m *AWSSecretsManager) Get(ctx context.Context, key string) (string, error)

Get retrieves a secret from AWS Secrets Manager.

type AzureConfig

type AzureConfig struct {
	VaultURL string `yaml:"vault_url" json:"vault_url"`
}

type AzureKeyVaultManager

type AzureKeyVaultManager struct {
	// contains filtered or unexported fields
}

AzureKeyVaultManager implements secrets.Manager for Azure Key Vault.

func NewAzureKeyVaultManager

func NewAzureKeyVaultManager(vaultURL string) (*AzureKeyVaultManager, error)

NewAzureKeyVaultManager creates a new AzureKeyVaultManager.

func (*AzureKeyVaultManager) Get

func (m *AzureKeyVaultManager) Get(ctx context.Context, key string) (string, error)

Get retrieves a secret from Azure Key Vault.

type CombinedManager

type CombinedManager struct {
	Managers []Manager
}

CombinedManager tries multiple secret managers in order.

func (*CombinedManager) Get

func (m *CombinedManager) Get(ctx context.Context, key string) (string, error)

type Config

type Config struct {
	Type    string      `yaml:"type" json:"type"` // env, vault, aws, azure, openbao
	Vault   VaultConfig `yaml:"vault" json:"vault"`
	OpenBao VaultConfig `yaml:"openbao" json:"openbao"` // OpenBao uses same config as Vault
	AWS     AWSConfig   `yaml:"aws" json:"aws"`
	Azure   AzureConfig `yaml:"azure" json:"azure"`
	Env     EnvConfig   `yaml:"env" json:"env"`
}

Config defines the configuration for secret managers.

type EnvConfig

type EnvConfig struct {
	Prefix string `yaml:"prefix" json:"prefix"`
}

type EnvManager

type EnvManager struct {
	Prefix string
}

EnvManager resolves secrets from environment variables.

func (*EnvManager) Get

func (m *EnvManager) Get(ctx context.Context, key string) (string, error)

type Manager

type Manager interface {
	Get(ctx context.Context, key string) (string, error)
}

Manager defines the interface for external secret managers.

func NewManager

func NewManager(ctx context.Context, cfg Config) (Manager, error)

NewManager creates a secret manager based on the provided configuration.

type OpenBaoManager

type OpenBaoManager struct {
	// contains filtered or unexported fields
}

OpenBaoManager implements secrets.Manager for OpenBao. Since OpenBao is wire-compatible with HashiCorp Vault, we use the same client.

func NewOpenBaoManager

func NewOpenBaoManager(address, token, mount string) (*OpenBaoManager, error)

NewOpenBaoManager creates a new OpenBaoManager.

func (*OpenBaoManager) Get

func (m *OpenBaoManager) Get(ctx context.Context, key string) (string, error)

Get retrieves a secret from OpenBao. key format: "path/to/secret" or "path/to/secret:field" If field is not provided, it defaults to "value".

type VaultConfig

type VaultConfig struct {
	Address string `yaml:"address" json:"address"`
	Token   string `yaml:"token" json:"token"`
	Mount   string `yaml:"mount" json:"mount"`
}

type VaultManager

type VaultManager struct {
	// contains filtered or unexported fields
}

VaultManager implements secrets.Manager for HashiCorp Vault.

func NewVaultManager

func NewVaultManager(address, token, mount string) (*VaultManager, error)

NewVaultManager creates a new VaultManager.

func (*VaultManager) Get

func (m *VaultManager) Get(ctx context.Context, key string) (string, error)

Get retrieves a secret from Vault. key format: "path/to/secret" or "path/to/secret:field" If field is not provided, it defaults to "value".

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL