Help us shape the future of Go! Take the 2026 Go Developer Survey

openbao

package
v0.4.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 20, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Index

Constants

View Source 
const RuntimeExecutorDNSName = "baseharbor-runtime-executor"

Variables

View Source 
var (
	ErrNotInitialized       = errors.New("OpenBao is not initialized")
	ErrAlreadyInitialized   = errors.New("OpenBao is already initialized")
	ErrSealed               = errors.New("OpenBao is sealed")
	ErrManagerNotConfigured = errors.New("OpenBao manager credentials are not configured")
	ErrInvalidRecoveryFile  = errors.New("invalid OpenBao recovery file")
)
View Source 
var ErrApplicationScopeUnavailable = errors.New("OpenBao application secret scope is unavailable")
View Source 
var ErrApplicationSecretNotFound = errors.New("application secret does not exist")

Functions

func AdminCredentialsPath 

func AdminCredentialsPath(files bhruntime.Files) string

func ApplicationCredentialsPath 

func ApplicationCredentialsPath(runtimeDir string) string

func Bootstrap 

func Bootstrap(ctx context.Context, executor Executor, files bhruntime.Files, recoveryPath string) error

Bootstrap initializes the single-node Shamir seal workflow, writes only the unseal material to an operator-selected recovery file, configures a KV v2 mount plus a least-privilege manager AppRole, and revokes the initial root token after the manager identity has been verified.

func CheckApplicationProvisioning 

func CheckApplicationProvisioning(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

CheckApplicationProvisioning verifies the non-mutating prerequisites that can be established without granting the manager token extra system introspection privileges. The subsequent convergence step remains authoritative for the actual policy/AppRole mutation and fails closed if those writes are denied.

func CheckApplicationScope 

func CheckApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func CheckApplicationScopeOwnership 

func CheckApplicationScopeOwnership(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

func CheckManager 

func CheckManager(ctx context.Context, executor Executor, files bhruntime.Files) error

func DeleteApplicationSecret 

func DeleteApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string) error

func DestroyApplicationScope 

func DestroyApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

func DestroyVerifiedApplicationScope 

func DestroyVerifiedApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity) error

DestroyVerifiedApplicationScope is the destructive application-scope entrypoint. It validates the exact BaseHarbor-managed policy and AppRole before any application secret metadata or identity object is removed.

func EnsureApplicationScope 

func EnsureApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func EnsureApplicationSecretNamespace 

func EnsureApplicationSecretNamespace(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func GetApplicationSecret 

func GetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)

GetApplicationSecret returns one application-scoped secret value. Callers must already be authorized for the owning application; OpenBao credentials further confine the read to that application's namespace.

func InspectApplicationScope 

func InspectApplicationScope(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) error

func ListApplicationSecretKeys 

func ListApplicationSecretKeys(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) ([]string, error)

func RequireApplicationSecrets 

func RequireApplicationSecrets(statuses []RequiredSecretStatus) error

func RestoreApplicationSecrets 

func RestoreApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, backup ApplicationSecretBackup) error

func SetApplicationSecret 

func SetApplicationSecret(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath, key string, value []byte) error

func Unseal 

func Unseal(ctx context.Context, executor Executor, files bhruntime.Files, recoveryPath string) error

Types

type AdminCredentials 

type AdminCredentials struct {
	RoleID   string
	SecretID string
}

func LoadAdminCredentials 

func LoadAdminCredentials(files bhruntime.Files) (AdminCredentials, error)

type ApplicationCredentials 

type ApplicationCredentials struct {
	RoleID   string
	SecretID string
}

type ApplicationIdentity 

type ApplicationIdentity struct {
	Name        string
	Environment string
}

type ApplicationRuntimeClient 

type ApplicationRuntimeClient struct {
	// contains filtered or unexported fields
}

ApplicationRuntimeClient is the narrow OpenBao data-plane client used by the managed runtime API. It authenticates only with each application's AppRole; it never receives the BaseHarbor manager identity or a root token.

func NewApplicationRuntimeClient 

func NewApplicationRuntimeClient(rawURL string) (*ApplicationRuntimeClient, error)

func (*ApplicationRuntimeClient) Check 

func (c *ApplicationRuntimeClient) Check(ctx context.Context, credentialsPath string) error

func (*ApplicationRuntimeClient) DeleteApplicationSecret 

func (c *ApplicationRuntimeClient) DeleteApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) error

func (*ApplicationRuntimeClient) GetApplicationSecret 

func (c *ApplicationRuntimeClient) GetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string) ([]byte, error)

func (*ApplicationRuntimeClient) SetApplicationSecret 

func (c *ApplicationRuntimeClient) SetApplicationSecret(ctx context.Context, identity ApplicationIdentity, credentialsPath, key string, value []byte) error

type ApplicationSecretBackup 

type ApplicationSecretBackup struct {
	Identity ApplicationIdentity
	Secrets  []ApplicationSecretBackupEntry
}

func ExportApplicationSecrets 

func ExportApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string) (ApplicationSecretBackup, error)

type ApplicationSecretBackupEntry 

type ApplicationSecretBackupEntry struct {
	Key   string
	Value []byte
}

type Executor 

type Executor interface {
	ExecProject(ctx context.Context, project, composeFile, envFile, service string, args ...string) (string, error)
	ExecProjectInput(ctx context.Context, project, composeFile, envFile string, input []byte, service string, args ...string) (string, error)
}

Executor is the narrow runtime boundary required for OpenBao lifecycle work. Sensitive input must be supplied through stdin rather than command arguments.

type RequiredSecretStatus 

type RequiredSecretStatus struct {
	Name      string
	Present   bool
	Usable    bool
	Generated bool
}

RequiredSecretStatus contains readiness metadata only. It never exposes the secret value that was read to prove usability. Generated is caller-supplied declaration metadata and is intentionally not inferred from the stored value.

func InspectRequiredApplicationSecrets 

func InspectRequiredApplicationSecrets(ctx context.Context, executor Executor, files bhruntime.Files, identity ApplicationIdentity, credentialsPath string, required []string) ([]RequiredSecretStatus, error)

type RuntimeExecutorMTLSFiles added in v0.4.8 

type RuntimeExecutorMTLSFiles struct {
	CA   string
	Cert string
	Key  string
}

func EnsureRuntimeExecutorMTLSIdentity added in v0.4.8 

func EnsureRuntimeExecutorMTLSIdentity(ctx context.Context, executor Executor, platformFiles bhruntime.Files, dir string) (RuntimeExecutorMTLSFiles, bool, error)

type RuntimeMTLSFiles 

type RuntimeMTLSFiles struct {
	CA         string
	BrokerCert string
	BrokerKey  string
	ClientCert string
	ClientKey  string
}

func EnsureRuntimeMTLSIdentity 

func EnsureRuntimeMTLSIdentity(ctx context.Context, executor Executor, platformFiles bhruntime.Files, identity ApplicationIdentity, appFiles application.RuntimeFiles) (RuntimeMTLSFiles, bool, error)

EnsureRuntimeMTLSIdentity issues a per-application broker/server identity and client identity from a BaseHarbor-internal CA. The CA private key is stored in the manager-only OpenBao namespace and is never persisted in application or control-plane filesystem state.

type State 

type State struct {
	Initialized bool   `json:"initialized"`
	Sealed      bool   `json:"sealed"`
	Version     string `json:"version"`
}

func Inspect 

func Inspect(ctx context.Context, executor Executor, files bhruntime.Files) (State, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.