README
¶
Example static key provider
[!WARNING] This file is not an end-user documentation, it is intended for developers. Please follow the user documentation on the OpenTofu website unless you want to work on the encryption code.
[!WARNING] This provider is not intended for production use and merely serves as a simple example!
This folder contains a key provider that accepts a static, hex-encoded key. Its only purpose is to serve as a provider for tests and as a demonstration on implementing a key provider.
Documentation
¶
Overview ¶
Package static contains a key provider that emits a static key.
Example ¶
Example is a full end-to-end example of encrypting and decrypting a plan file.
package main
import (
"context"
"fmt"
"strings"
"github.com/intentius/choudoufu/internal/configs"
"github.com/intentius/choudoufu/internal/encryption"
"github.com/intentius/choudoufu/internal/encryption/config"
"github.com/intentius/choudoufu/internal/encryption/keyprovider/static"
"github.com/intentius/choudoufu/internal/encryption/method/aesgcm"
"github.com/intentius/choudoufu/internal/encryption/registry/lockingencryptionregistry"
)
var hclConfig = `key_provider "static" "foo" {
key = "6f6f706830656f67686f6834616872756f3751756165686565796f6f72653169"
}
method "aes_gcm" "bar" {
keys = key_provider.static.foo
}
plan {
method = method.aes_gcm.bar
}
`
// Example is a full end-to-end example of encrypting and decrypting a plan file.
func main() {
registry := lockingencryptionregistry.New()
if err := registry.RegisterKeyProvider(static.New()); err != nil {
panic(err)
}
if err := registry.RegisterMethod(aesgcm.New()); err != nil {
panic(err)
}
cfg, diags := config.LoadConfigFromString("test.hcl", hclConfig)
if diags.HasErrors() {
panic(diags)
}
staticEvaluator := configs.NewStaticEvaluator(nil, nil, configs.RootModuleCallForTesting())
enc, diags := encryption.New(context.Background(), registry, cfg, staticEvaluator)
if diags.HasErrors() {
panic(diags)
}
encryptor := enc.Plan()
encryptedPlan, err := encryptor.EncryptPlan([]byte("Hello world!"))
if err != nil {
panic(err)
}
if strings.Contains(string(encryptedPlan), "Hello world!") {
panic("The plan was not encrypted!")
}
decryptedPlan, err := encryptor.DecryptPlan(encryptedPlan)
if err != nil {
panic(err)
}
fmt.Printf("%s", decryptedPlan)
}
Output: Hello world!
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Key string `hcl:"key"`
}
Config contains the configuration for this key provider supplied by the user. This struct must have hcl tags in order to function.
Example ¶
This example is a bare-bones configuration for a static key provider. It is mainly intended to demonstrate how you can use parse configuration and construct a static key provider from in. And is not intended to be used as a real-world example.
package main
import (
"fmt"
"github.com/hashicorp/hcl/v2/gohcl"
config2 "github.com/intentius/choudoufu/internal/encryption/config"
"github.com/intentius/choudoufu/internal/encryption/keyprovider/static"
)
var exampleConfig = `key_provider "static" "foo" {
key = "6f6f706830656f67686f6834616872756f3751756165686565796f6f72653169"
}
`
// This example is a bare-bones configuration for a static key provider.
// It is mainly intended to demonstrate how you can use parse configuration
// and construct a static key provider from in.
// And is not intended to be used as a real-world example.
func main() {
staticConfig := static.New().ConfigStruct()
// Parse the config:
parsedConfig, diags := config2.LoadConfigFromString("config.hcl", exampleConfig)
if diags.HasErrors() {
panic(diags)
}
if len(parsedConfig.KeyProviderConfigs) != 1 {
panic("Expected 1 key provider")
}
// Grab the KeyProvider from the parsed config:
keyProvider := parsedConfig.KeyProviderConfigs[0]
// assert the Type is "static" and the Name is "foo"
if keyProvider.Type != "static" {
panic("Expected key provider type to be 'static'")
}
if keyProvider.Name != "foo" {
panic("Expected key provider name to be 'foo'")
}
// Use gohcl to parse the hcl block from parsedConfig into the static configuration struct
// This is not the intended path, and it should be handled by the implementation of the Encryption
// interface.
//
// This is just an example of how to use the static configuration struct, and this is how testing
// may be carried out.
if err := gohcl.DecodeBody(parsedConfig.KeyProviderConfigs[0].Body, nil, staticConfig); err != nil {
panic(err)
}
// Cast the static configuration struct to a static.Config so that we can assert against the key
// value
s := staticConfig.(*static.Config)
fmt.Printf("%s\n", s.Key)
}
Output: 6f6f706830656f67686f6834616872756f3751756165686565796f6f72653169
func (Config) Build ¶
func (c Config) Build() (keyprovider.KeyProvider, keyprovider.KeyMeta, error)
Build will create the usable key provider.
type Descriptor ¶
type Descriptor interface {
keyprovider.Descriptor
}
Descriptor is an additional interface to allow for providing custom methods.
func New ¶
func New() Descriptor
Source Files