README
¶
External key provider
[!WARNING] This file is not an end-user documentation, it is intended for developers. Please follow the user documentation on the OpenTofu website unless you want to work on the encryption code.
This directory contains the external key provider. You can configure it like this:
terraform {
encryption {
key_provider "external" "foo" {
command = ["/path/to/binary", "arg1", "arg2"]
}
}
}
The external key provider must implement the following protocol:
- On start, the provider must emit the header line matching the header schema on the standard output.
- OpenTofu supplies
nullor the input metadata matching the input schema on the standard input. - The provider must emit the key material matching the output schema on the standard output.
Documentation
¶
Index ¶
Constants ¶
const HeaderMagic = "OpenTofu-External-Key-Provider"
HeaderMagic is the magic string that needs to be present in the header to identify the external program as an external keyprovider for OpenTofu.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Command []string `hcl:"command"`
}
func (*Config) Build ¶
func (c *Config) Build() (keyprovider.KeyProvider, keyprovider.KeyMeta, error)
type Descriptor ¶
type Descriptor interface {
keyprovider.Descriptor
TypedConfig() *Config
}
func New ¶
func New() Descriptor
type Header ¶
type Header struct {
// Magic must always be "OpenTofu-External-Key-Provider".
Magic string `json:"magic"`
// Version is the protocol version number. This currently must be 1.
Version int `json:"version"`
}
Header describes the initial header the external program must output as a single line, followed by a single newline.
type InputV1 ¶
type InputV1 *MetadataV1
InputV1 describes the input datastructure passed in over stdin. This structure is valid for protocol version 1.
type MetadataV1 ¶
MetadataV1 describes the metadata structure of the external provider.
func (*MetadataV1) Encode ¶
func (m *MetadataV1) Encode() ([]byte, error)
Encode encodes the current MetadataV1 to work properly with external key providers. When the MetadataV1.ExternalData is nil, it returns "null". The MetadataV1.ExternalData can be an empty map, which is a valid case meaning that it should return that encoded accordingly.
type OutputV1 ¶
type OutputV1 struct {
Keys keyprovider.Output `json:"keys"`
Meta MetadataV1 `json:"meta,omitempty"`
}
OutputV1 describes the output datastructure written to stdout by the external program. This structure is valid for protocol version 1.
Source Files
Directories