Documentation
¶
Overview ¶
Package secrets is the credential-source client tier: it selects a secret backend — an environment variable (env/), a git-ignored local file (file/), or AWS Secrets Manager (awssm/) — by Kind and returns the interfaces.Source contract, so switching where a credential is read is a configuration change, not a caller edit. The contract (interfaces.Source plus the opaque types.Secret) lives in core; each backend implements it; this is the factory, mirroring the cache/storage/auth NewFromConfig pattern.
This tier is the generic MECHANISM. The Ref→backend-address mapping is supplied by the caller as POLICY — this tier knows nothing of any specific credential's meaning, and routing a Ref to a particular Kind is likewise the caller's concern.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewFromConfig ¶
NewFromConfig builds the credential Source selected by cfg.Kind: environment variables (KindEnv), a git-ignored file (KindFile), or AWS Secrets Manager (KindAWSSM). It is the app-wiring entrypoint and fails loudly on an unknown Kind or a Kind whose required dependency (the file backend's CommandRunner) is missing.
Types ¶
type Config ¶
type Config struct {
// EnvVars maps a Ref to its environment variable name (KindEnv).
EnvVars map[types.Ref]string
// Files maps a Ref to its git-ignored file location (KindFile).
Files map[types.Ref]file.Location
// Secrets maps a Ref to its Secrets Manager location (KindAWSSM).
Secrets map[types.Ref]awssm.Location
// Runner runs `git check-ignore` for the file backend's write guard (KindFile).
Runner interfaces.CommandRunner
// Region is the AWS region for the Secrets Manager backend (KindAWSSM).
Region string
// Kind selects the backend. The zero value is KindEnv.
Kind Kind
}
Config selects and configures the credential backend. Only the fields for the selected Kind are consulted; each map is the caller-supplied Ref→address policy.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package awssm implements the AWS Secrets Manager credential Source: it reads a credential from a Secrets Manager secret (a JSON object) named by a caller-supplied Ref→location mapping, extracting the configured JSON field.
|
Package awssm implements the AWS Secrets Manager credential Source: it reads a credential from a Secrets Manager secret (a JSON object) named by a caller-supplied Ref→location mapping, extracting the configured JSON field. |
|
Package env implements the environment-variable credential Source: it resolves a Ref to a configured environment variable name and reads its value via os.Getenv.
|
Package env implements the environment-variable credential Source: it resolves a Ref to a configured environment variable name and reads its value via os.Getenv. |
|
Package file implements the file-backed credential Source: it reads and writes credentials in a git-ignored local file (a dotenv-style KEY=value store) named by a caller-supplied Ref→location mapping.
|
Package file implements the file-backed credential Source: it reads and writes credentials in a git-ignored local file (a dotenv-style KEY=value store) named by a caller-supplied Ref→location mapping. |