Documentation
¶
Index ¶
- Variables
- func AdminCredentialsPath(files bhruntime.Files) string
- func ApplicationCredentialsPath(runtimeDir string) string
- func Bootstrap(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func CheckApplicationProvisioning(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func CheckApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func CheckApplicationScopeOwnership(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func CheckManager(ctx context.Context, executor Executor, files bhruntime.Files) error
- func DeleteApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func DestroyApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func DestroyVerifiedApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func EnsureApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func EnsureApplicationSecretNamespace(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func GetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, ...) ([]byte, error)
- func InspectApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func ListApplicationSecretKeys(ctx context.Context, executor Executor, files bhruntime.Files, ...) ([]string, error)
- func RequireApplicationSecrets(statuses []RequiredSecretStatus) error
- func RestoreApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func SetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- func Unseal(ctx context.Context, executor Executor, files bhruntime.Files, ...) error
- type AdminCredentials
- type ApplicationCredentials
- type ApplicationIdentity
- type ApplicationRuntimeClient
- func (c *ApplicationRuntimeClient) Check(ctx context.Context, credentialsPath string) error
- func (c *ApplicationRuntimeClient) DeleteApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) error
- func (c *ApplicationRuntimeClient) GetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)
- func (c *ApplicationRuntimeClient) SetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string, ...) error
- type ApplicationSecretBackup
- type ApplicationSecretBackupEntry
- type Executor
- type RequiredSecretStatus
- type RuntimeMTLSFiles
- type State
Constants ¶
This section is empty.
Variables ¶
var ( ErrNotInitialized = errors.New("OpenBao is not initialized") ErrAlreadyInitialized = errors.New("OpenBao is already initialized") ErrSealed = errors.New("OpenBao is sealed") ErrManagerNotConfigured = errors.New("OpenBao manager credentials are not configured") ErrInvalidRecoveryFile = errors.New("invalid OpenBao recovery file") )
var ErrApplicationSecretNotFound = errors.New("application secret does not exist")
Functions ¶
func AdminCredentialsPath ¶
func Bootstrap ¶
func Bootstrap(ctx context.Context, executor Executor, files bhruntime.Files, recoveryPath string) error
Bootstrap initializes the single-node Shamir seal workflow, writes only the unseal material to an operator-selected recovery file, configures a KV v2 mount plus a least-privilege manager AppRole, and revokes the initial root token after the manager identity has been verified.
func CheckApplicationProvisioning ¶
func CheckApplicationProvisioning(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error
CheckApplicationProvisioning verifies the non-mutating prerequisites that can be established without granting the manager token extra system introspection privileges. The subsequent convergence step remains authoritative for the actual policy/AppRole mutation and fails closed if those writes are denied.
func CheckApplicationScope ¶
func CheckManager ¶
func DeleteApplicationSecret ¶
func DestroyApplicationScope ¶
func DestroyVerifiedApplicationScope ¶
func DestroyVerifiedApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error
DestroyVerifiedApplicationScope is the destructive application-scope entrypoint. It validates the exact BaseHarbor-managed policy and AppRole before any application secret metadata or identity object is removed.
func EnsureApplicationScope ¶
func GetApplicationSecret ¶
func GetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)
GetApplicationSecret returns one application-scoped secret value. Callers must already be authorized for the owning application; OpenBao credentials further confine the read to that application's namespace.
func InspectApplicationScope ¶
func RequireApplicationSecrets ¶
func RequireApplicationSecrets(statuses []RequiredSecretStatus) error
func RestoreApplicationSecrets ¶
func RestoreApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, backup ApplicationSecretBackup) error
func SetApplicationSecret ¶
Types ¶
type AdminCredentials ¶
func LoadAdminCredentials ¶
func LoadAdminCredentials(files bhruntime.Files) (AdminCredentials, error)
type ApplicationCredentials ¶
type ApplicationIdentity ¶
type ApplicationRuntimeClient ¶
type ApplicationRuntimeClient struct {
// contains filtered or unexported fields
}
ApplicationRuntimeClient is the narrow OpenBao data-plane client used by the managed runtime API. It authenticates only with each application's AppRole; it never receives the BaseHarbor manager identity or a root token.
func NewApplicationRuntimeClient ¶
func NewApplicationRuntimeClient(rawURL string) (*ApplicationRuntimeClient, error)
func (*ApplicationRuntimeClient) Check ¶
func (c *ApplicationRuntimeClient) Check(ctx context.Context, credentialsPath string) error
func (*ApplicationRuntimeClient) DeleteApplicationSecret ¶
func (c *ApplicationRuntimeClient) DeleteApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) error
func (*ApplicationRuntimeClient) GetApplicationSecret ¶
func (c *ApplicationRuntimeClient) GetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)
func (*ApplicationRuntimeClient) SetApplicationSecret ¶
func (c *ApplicationRuntimeClient) SetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string, value []byte) error
type ApplicationSecretBackup ¶
type ApplicationSecretBackup struct {
Identity ApplicationIdentity
Secrets []ApplicationSecretBackupEntry
}
func ExportApplicationSecrets ¶
func ExportApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) (ApplicationSecretBackup, error)
type Executor ¶
type Executor interface {
ExecProject(ctx context.Context, project, composeFile, envFile, service string, args ...string) (string, error)
ExecProjectInput(ctx context.Context, project, composeFile, envFile string, input []byte, service string, args ...string) (string, error)
}
Executor is the narrow runtime boundary required for OpenBao lifecycle work. Sensitive input must be supplied through stdin rather than command arguments.
type RequiredSecretStatus ¶
RequiredSecretStatus contains readiness metadata only. It never exposes the secret value that was read to prove usability. Generated is caller-supplied declaration metadata and is intentionally not inferred from the stored value.
func InspectRequiredApplicationSecrets ¶
func InspectRequiredApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, required []string) ([]RequiredSecretStatus, error)
type RuntimeMTLSFiles ¶
type RuntimeMTLSFiles struct {
CA string
BrokerCert string
BrokerKey string
ClientCert string
ClientKey string
}
func EnsureRuntimeMTLSIdentity ¶
func EnsureRuntimeMTLSIdentity(ctx context.Context, executor Executor, platformFiles bhruntime.Files, identity ApplicationIdentity, appFiles application.RuntimeFiles) (RuntimeMTLSFiles, bool, error)
EnsureRuntimeMTLSIdentity issues a per-application broker/server identity and client identity from a BaseHarbor-internal CA. The CA private key is stored in the manager-only OpenBao namespace and is never persisted in application or control-plane filesystem state.
Source Files
¶
- application_required_secrets.go
- application_runtime_client.go
- application_scope.go
- application_scope_destroy.go
- application_scope_inspect.go
- application_scope_ownership.go
- application_scope_preflight.go
- application_secret_backup.go
- application_secret_read.go
- application_secret_values.go
- bootstrap.go
- runtime_pki.go