Documentation
¶
Overview ¶
Package keyvault resolves Azure Key Vault references found in environment variables.
Reference parsing, client construction, per-vault client caching, and secret retrieval are delegated to azdext.KeyVaultResolver. This package adds the KEY=VALUE slice API used by azd extensions and support for the versioned akvs://<subscription>/<vault>/<secret>/<version> form, which azdext does not parse on its own.
Three reference formats are accepted:
akvs://<subscription-id>/<vault-name>/<secret-name>[/<version>] @Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/<name>[/<version>]) @Microsoft.KeyVault(VaultName=<vault>;SecretName=<name>[;SecretVersion=<version>])
NewKeyVaultResolver authenticates with azidentity.DefaultAzureCredential. NewKeyVaultResolverWithCredential takes an explicit credential and options, which is how callers reach sovereign clouds or inject a fake secret client in tests.
Package keyvault provides Azure Key Vault reference resolution helpers.
This file contains the adapter that bridges the keyvault types with the env package's Resolver interface, enabling the env package to resolve Key Vault references without importing keyvault directly.
Package keyvault provides Azure Key Vault reference resolution helpers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsKeyVaultReference ¶
IsKeyVaultReference reports whether the value matches a supported reference format.
Surrounding whitespace and a single layer of matching quotes are ignored, so a value read straight out of a .env file is recognized.
Types ¶
type EnvResolutionWarning ¶ added in v0.6.0
EnvResolutionWarning captures non-fatal resolution failures in the adapter.
type EnvResolveOptions ¶ added in v0.6.0
type EnvResolveOptions struct {
StopOnError bool
}
EnvResolveOptions configures environment resolution behavior for the adapter.
type EnvResolverAdapter ¶ added in v0.6.0
type EnvResolverAdapter struct {
// contains filtered or unexported fields
}
EnvResolverAdapter adapts KeyVaultResolver to the env.Resolver interface, breaking the import cycle between env and keyvault packages.
func NewEnvResolverAdapter ¶ added in v0.6.0
func NewEnvResolverAdapter(resolver *KeyVaultResolver) *EnvResolverAdapter
NewEnvResolverAdapter creates an adapter that satisfies the env.Resolver interface.
func (*EnvResolverAdapter) IsSecretReference ¶ added in v0.6.0
func (a *EnvResolverAdapter) IsSecretReference(value string) bool
IsSecretReference reports whether a value is a Key Vault reference. This satisfies the env.SecretReferenceChecker interface.
func (*EnvResolverAdapter) ResolveEnvironmentVariables ¶ added in v0.6.0
func (a *EnvResolverAdapter) ResolveEnvironmentVariables(ctx context.Context, envVars []string, opts EnvResolveOptions) ([]string, []EnvResolutionWarning, error)
ResolveEnvironmentVariables resolves Key Vault references in KEY=VALUE entries. The opts parameter uses a generic struct with StopOnError to avoid importing env.
This method satisfies the env.Resolver interface via structural typing:
ResolveEnvironmentVariables(ctx context.Context, env []string, opts env.ResolveOptions) ([]string, []env.ResolutionWarning, error)
Since Go uses structural typing for interfaces, this adapter works as long as the method signature matches. The env package defines its own ResolveOptions and ResolutionWarning types that this adapter is compatible with.
type KeyVaultResolutionWarning ¶
KeyVaultResolutionWarning captures non-fatal resolution failures.
type KeyVaultResolver ¶
type KeyVaultResolver struct {
// contains filtered or unexported fields
}
KeyVaultResolver resolves Azure Key Vault references to secret values.
Reference parsing, client construction, per-vault client caching, and secret retrieval are all provided by azdext.KeyVaultResolver. This type adds the KEY=VALUE environment slice API that azd extensions use, and support for the versioned akvs form.
func NewKeyVaultResolver ¶
func NewKeyVaultResolver() (*KeyVaultResolver, error)
NewKeyVaultResolver builds a resolver using DefaultAzureCredential.
func NewKeyVaultResolverWithCredential ¶ added in v0.6.0
func NewKeyVaultResolverWithCredential( credential azcore.TokenCredential, opts *azdext.KeyVaultResolverOptions, ) (*KeyVaultResolver, error)
NewKeyVaultResolverWithCredential builds a resolver from an explicit credential.
Use this to supply an azdext.TokenProvider so secret resolution rides the extension's own azd issued token rather than a separate credential chain, to target a sovereign cloud through KeyVaultResolverOptions.VaultSuffix, or to inject a secret client in tests through KeyVaultResolverOptions.ClientFactory.
Passing nil opts selects the Azure public cloud and the real secret client.
func (*KeyVaultResolver) ResolveEnvironmentVariables ¶
func (r *KeyVaultResolver) ResolveEnvironmentVariables( ctx context.Context, envVars []string, options ResolveEnvironmentOptions, ) ([]string, []KeyVaultResolutionWarning, error)
ResolveEnvironmentVariables resolves references in KEY=VALUE entries.
Entries that are not KEY=VALUE, and values that are not Key Vault references, are passed through untouched. When a reference fails to resolve, the original entry is preserved and a warning is recorded. Set StopOnError to abort on the first failure instead.
func (*KeyVaultResolver) ResolveReference ¶
ResolveReference resolves a single Key Vault reference to its secret value.
Failures are returned as *azdext.KeyVaultResolveError, so callers can inspect Reason to distinguish a malformed reference from a missing secret, an access denial, or a service error.
type ResolveEnvironmentOptions ¶
type ResolveEnvironmentOptions struct {
StopOnError bool
}
ResolveEnvironmentOptions configures environment resolution behavior.
Source Files