Help us shape the future of Go! Take the 2026 Go Developer Survey

openbao

package
v0.4.16 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 27, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	RuntimeExecutorDNSName        = "baseharbor-runtime-executor"
	RuntimeExecutorObserverSPIFFE = "spiffe://baseharbor/platform/runtime-executor-observer"
)

Variables

View Source 
var (
	ErrNotInitialized       = errors.New("OpenBao is not initialized")
	ErrAlreadyInitialized   = errors.New("OpenBao is already initialized")
	ErrSealed               = errors.New("OpenBao is sealed")
	ErrManagerNotConfigured = errors.New("OpenBao manager credentials are not configured")
	ErrInvalidRecoveryFile  = errors.New("invalid OpenBao recovery file")
)
View Source 
var ErrApplicationScopeUnavailable = errors.New("OpenBao application secret scope is unavailable")
View Source 
var ErrApplicationSecretNotFound = errors.New("application secret does not exist")

Functions

func AdminCredentialsPath 

func AdminCredentialsPath(files bhruntime.Files) string

func ApplicationCredentialsPath 

func ApplicationCredentialsPath(runtimeDir string) string

func Bootstrap 

func Bootstrap(ctx context.Context, executor Executor, files bhruntime.Files, recoveryPath string) error

Bootstrap initializes the single-node Shamir seal workflow, writes only the unseal material to an operator-selected recovery file, configures a KV v2 mount plus a least-privilege manager AppRole, and revokes the initial root token after the manager identity has been verified.

func CheckApplicationProvisioning 

func CheckApplicationProvisioning(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

CheckApplicationProvisioning verifies the non-mutating prerequisites that can be established without granting the manager token extra system introspection privileges. The subsequent convergence step remains authoritative for the actual policy/AppRole mutation and fails closed if those writes are denied.

func CheckApplicationScope 

func CheckApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func CheckApplicationScopeOwnership 

func CheckApplicationScopeOwnership(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

func CheckManager 

func CheckManager(ctx context.Context, executor Executor, files bhruntime.Files) error

func DeleteApplicationSecret 

func DeleteApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string) error

func DestroyApplicationScope 

func DestroyApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

func DestroyVerifiedApplicationScope 

func DestroyVerifiedApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

DestroyVerifiedApplicationScope is the destructive application-scope entrypoint. It validates the exact BaseHarbor-managed policy and AppRole before any application secret metadata or identity object is removed.

func EnsureApplicationScope 

func EnsureApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func EnsureApplicationSecretNamespace 

func EnsureApplicationSecretNamespace(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func GetApplicationSecret 

func GetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)

GetApplicationSecret returns one application-scoped secret value. Callers must already be authorized for the owning application; OpenBao credentials further confine the read to that application's namespace.

func GetApplicationSecrets added in v0.4.11 

func GetApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, keys []string) (map[string][]byte, error)

func InspectApplicationScope 

func InspectApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func ListApplicationSecretKeys 

func ListApplicationSecretKeys(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) ([]string, error)

func RequireApplicationSecrets 

func RequireApplicationSecrets(statuses []RequiredSecretStatus) error

func RestoreApplicationSecrets 

func RestoreApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, backup ApplicationSecretBackup) error

func RevokeServiceCertificate added in v0.4.15 

func RevokeServiceCertificate(ctx context.Context, executor Executor, files bhruntime.Files, serial string) error

func ServiceCA added in v0.4.15 

func ServiceCA(ctx context.Context, executor Executor, files bhruntime.Files) ([]byte, error)

func SetApplicationSecret 

func SetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string, value []byte) error

func Unseal 

func Unseal(ctx context.Context, executor Executor, files bhruntime.Files, recoveryPath string) error

Types

type AdminCredentials 

type AdminCredentials struct {
	RoleID   string
	SecretID string
}

func LoadAdminCredentials 

func LoadAdminCredentials(files bhruntime.Files) (AdminCredentials, error)

type ApplicationCredentials 

type ApplicationCredentials struct {
	RoleID   string
	SecretID string
}

type ApplicationIdentity 

type ApplicationIdentity struct {
	Name        string
	Environment string
}

type ApplicationRuntimeClient 

type ApplicationRuntimeClient struct {
	// contains filtered or unexported fields
}

ApplicationRuntimeClient is the narrow OpenBao data-plane client used by the managed runtime API. It authenticates only with each application's AppRole; it never receives the BaseHarbor manager identity or a root token.

func NewApplicationRuntimeClient 

func NewApplicationRuntimeClient(rawURL string) (*ApplicationRuntimeClient, error)

func (*ApplicationRuntimeClient) Check 

func (c *ApplicationRuntimeClient) Check(ctx context.Context, credentialsPath string) error

func (*ApplicationRuntimeClient) DeleteApplicationSecret 

func (c *ApplicationRuntimeClient) DeleteApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) error

func (*ApplicationRuntimeClient) GetApplicationSecret 

func (c *ApplicationRuntimeClient) GetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)

func (*ApplicationRuntimeClient) SetApplicationSecret 

func (c *ApplicationRuntimeClient) SetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string, value []byte) error

type ApplicationSecretBackup 

type ApplicationSecretBackup struct {
	Identity ApplicationIdentity
	Secrets  []ApplicationSecretBackupEntry
}

func ExportApplicationSecrets 

func ExportApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) (ApplicationSecretBackup, error)

type ApplicationSecretBackupEntry 

type ApplicationSecretBackupEntry struct {
	Key   string
	Value []byte
}

type Executor 

type Executor interface {
	ExecProject(ctx context.Context, project, composeFile, envFile, service string, args ...string) (string, error)
	ExecProjectInput(ctx context.Context, project, composeFile, envFile string, input []byte, service string, args ...string) (string, error)
}

Executor is the narrow runtime boundary required for OpenBao lifecycle work. Sensitive input must be supplied through stdin rather than command arguments.

type RequiredSecretStatus 

type RequiredSecretStatus struct {
	Name      string
	Present   bool
	Usable    bool
	Generated bool
}

RequiredSecretStatus contains readiness metadata only. It never exposes the secret value that was read to prove usability. Generated is caller-supplied declaration metadata and is intentionally not inferred from the stored value.

func InspectRequiredApplicationSecrets 

func InspectRequiredApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, required []string) ([]RequiredSecretStatus, error)

type RuntimeExecutorMTLSFiles added in v0.4.8 

type RuntimeExecutorMTLSFiles struct {
	CA         string
	Cert       string
	Key        string
	ClientCert string
	ClientKey  string
}

func EnsureRuntimeExecutorMTLSIdentity added in v0.4.8 

func EnsureRuntimeExecutorMTLSIdentity(ctx context.Context, issuer serviceaccess.Issuer, dir string) (RuntimeExecutorMTLSFiles, bool, error)

type RuntimeMTLSFiles 

type RuntimeMTLSFiles struct {
	CA           string
	BrokerCert   string
	BrokerKey    string
	ClientCert   string
	ClientKey    string
	WorkloadCert string
	WorkloadKey  string
}

func EnsureRuntimeMTLSIdentity 

func EnsureRuntimeMTLSIdentity(ctx context.Context, issuer serviceaccess.Issuer, identity ApplicationIdentity, appFiles application.RuntimeFiles, workloadDNSNames []string) (RuntimeMTLSFiles, bool, error)

EnsureRuntimeMTLSIdentity preserves the application-scoped runtime identity contract while delegating all certificate issuance to the managed service issuer. BaseHarbor no longer stores or uses a CA private key in Go code.

type ServiceCertificate added in v0.4.15 

type ServiceCertificate struct {
	Certificate []byte
	PrivateKey  []byte
	IssuingCA   []byte
	CAChain     [][]byte
	Serial      string
	ExpiresAt   time.Time
}

func IssueServiceCertificate added in v0.4.15 

func IssueServiceCertificate(ctx context.Context, executor Executor, files bhruntime.Files, request ServiceCertificateRequest) (ServiceCertificate, error)

type ServiceCertificateRequest added in v0.4.15 

type ServiceCertificateRequest struct {
	CommonName  string
	DNSNames    []string
	IPAddresses []net.IP
	URIs        []*url.URL
	TTL         time.Duration
}

type ServiceIssuer added in v0.4.15 

type ServiceIssuer struct {
	// contains filtered or unexported fields
}

ServiceIssuer adapts the managed OpenBao PKI engine to the provider-neutral service-access issuer contract.

func NewServiceIssuer added in v0.4.15 

func NewServiceIssuer(executor Executor, files bhruntime.Files) *ServiceIssuer

func (*ServiceIssuer) Issue added in v0.4.15 

func (i *ServiceIssuer) Issue(ctx context.Context, request serviceaccess.CertificateRequest) (serviceaccess.IssuedCertificate, error)

func (*ServiceIssuer) Renew added in v0.4.15 

func (i *ServiceIssuer) Renew(ctx context.Context, _ serviceaccess.IssuedCertificate, request serviceaccess.CertificateRequest) (serviceaccess.IssuedCertificate, error)

func (*ServiceIssuer) Revoke added in v0.4.15 

func (i *ServiceIssuer) Revoke(ctx context.Context, serial string) error

func (*ServiceIssuer) Status added in v0.4.15 

func (i *ServiceIssuer) Status(ctx context.Context) (serviceaccess.IssuerStatus, error)

func (*ServiceIssuer) TrustBundle added in v0.4.15 

func (i *ServiceIssuer) TrustBundle(ctx context.Context) (serviceaccess.TrustBundle, error)

type State 

type State struct {
	Initialized bool   `json:"initialized"`
	Sealed      bool   `json:"sealed"`
	Version     string `json:"version"`
}

func Inspect 

func Inspect(ctx context.Context, executor Executor, files bhruntime.Files) (State, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.