secrets

type AWSConfig ¶

type AWSConfig struct {
	Region string `yaml:"region" json:"region"`
}

type AWSSecretsManager ¶

type AWSSecretsManager struct {
	// contains filtered or unexported fields
}

AWSSecretsManager implements secrets.Manager for AWS Secrets Manager.

func NewAWSSecretsManager(ctx context.Context, region string) (*AWSSecretsManager, error)

func (m *AWSSecretsManager) Get(ctx context.Context, key string) (string, error)

type AzureConfig ¶

type AzureConfig struct {
	VaultURL string `yaml:"vault_url" json:"vault_url"`
}

type AzureKeyVaultManager ¶

type AzureKeyVaultManager struct {
	// contains filtered or unexported fields
}

AzureKeyVaultManager implements secrets.Manager for Azure Key Vault.

func NewAzureKeyVaultManager(vaultURL string) (*AzureKeyVaultManager, error)

func (m *AzureKeyVaultManager) Get(ctx context.Context, key string) (string, error)

type CachedManager ¶ added in v1.17.0

type CachedManager struct {
	// contains filtered or unexported fields
}

CachedManager remembers what another Manager answered. It is what the expression functions secret() and env() read through.

An expression reads its secrets once per message. Against Vault, OpenBao, AWS or Azure that is a network call per message, and a manager that stops answering would hold every message behind it. So a lookup has a timeout; an answer -- a missing secret included -- is kept for ttl; lookups for one key that miss at the same moment share a single call; and a failure is not kept, so the next message asks again. The keys come from expressions a workflow editor writes, so at most maxKeys are held, and the oldest goes first.

func NewCachedManager(inner Manager, ttl time.Duration, maxKeys int, timeout time.Duration) *CachedManager

func (c *CachedManager) Get(ctx context.Context, key string) (string, error)

func (c *CachedManager) GetScoped(ctx context.Context, vhost, key string) (string, error)

func (c *CachedManager) Invalidate(vhost, key string)

type CombinedManager ¶

type CombinedManager struct {
	Managers []Manager
}

CombinedManager tries multiple secret managers in order.

func (m *CombinedManager) Get(ctx context.Context, key string) (string, error)

type Config ¶

type Config struct {
	Type    string      `yaml:"type" json:"type"` // env, vault, aws, azure, openbao
	Vault   VaultConfig `yaml:"vault" json:"vault"`
	OpenBao VaultConfig `yaml:"openbao" json:"openbao"` // OpenBao uses same config as Vault
	AWS     AWSConfig   `yaml:"aws" json:"aws"`
	Azure   AzureConfig `yaml:"azure" json:"azure"`
	Env     EnvConfig   `yaml:"env" json:"env"`
}

Config defines the configuration for secret managers.

type EnvConfig ¶

type EnvConfig struct {
	Prefix string `yaml:"prefix" json:"prefix"`
}

type EnvManager ¶

type EnvManager struct {
	Prefix string
}

EnvManager resolves secrets from environment variables.

func (m *EnvManager) Get(ctx context.Context, key string) (string, error)

type Manager ¶

type Manager interface {
	Get(ctx context.Context, key string) (string, error)
}

Manager defines the interface for external secret managers.

func NewManager(ctx context.Context, cfg Config) (Manager, error)

type OpenBaoManager ¶

type OpenBaoManager struct {
	// contains filtered or unexported fields
}

OpenBaoManager implements secrets.Manager for OpenBao. Since OpenBao is wire-compatible with HashiCorp Vault, we use the same client.

func NewOpenBaoManager(address, token, mount string) (*OpenBaoManager, error)

func (m *OpenBaoManager) Get(ctx context.Context, key string) (string, error)

type ScopedManager ¶ added in v1.17.0

type ScopedManager interface {
	GetScoped(ctx context.Context, vhost, key string) (string, error)
}

ScopedManager answers a secret for the vhost asking for it.

type VHostManager ¶ added in v1.17.0

type VHostManager struct {
	Store  VHostStore
	Global Manager
}

VHostManager answers a secret from the asking vhost's own store, and from the global manager when that vhost holds none by the name. A vhost can therefore keep its own API_KEY, override a shared one, and still read the HERMOD_SECRET_ variables or Vault entries it read before. It is never answered from another vhost's store.

func (m *VHostManager) Get(ctx context.Context, key string) (string, error)

func (m *VHostManager) GetScoped(ctx context.Context, vhost, key string) (string, error)

type VHostStore ¶ added in v1.17.0

type VHostStore interface {
	VHostSecret(ctx context.Context, vhost, name string) (value string, found bool, err error)
}

VHostStore reads one secret a vhost holds; found is false when it has none by that name.

type VaultConfig ¶

type VaultConfig struct {
	Address string `yaml:"address" json:"address"`
	Token   string `yaml:"token" json:"token"`
	Mount   string `yaml:"mount" json:"mount"`
}

type VaultManager ¶

type VaultManager struct {
	// contains filtered or unexported fields
}

VaultManager implements secrets.Manager for HashiCorp Vault.

func NewVaultManager(address, token, mount string) (*VaultManager, error)

func (m *VaultManager) Get(ctx context.Context, key string) (string, error)