Documentation
¶
Overview ¶
Package secrets provides a pluggable secrets broker for VaultRun.
At run time, callers request named secrets (e.g. "DB_PASSWORD", "API_KEY"). The broker resolves them from the configured backend and injects them as environment variables into the container exec — they are never stored in the database or logged.
Supported backends (configured via SECRETS_PROVIDER env var):
- "env" — read VAULTRUN_SECRET_<NAME> from the server process environment (default)
- "vault" — HashiCorp Vault KV v2 via HTTP API
- "aws" — AWS Secrets Manager via HTTP API (SigV4 signed)
Index ¶
Constants ¶
const MinRedactLen = 4
MinRedactLen is the shortest secret value that is redacted. Shorter values would corrupt ordinary output (a secret "1" would blank every digit one).
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AWSProvider ¶
type AWSProvider struct {
// contains filtered or unexported fields
}
AWSProvider fetches secrets from AWS Secrets Manager using the AWS REST API.
Configuration env vars (standard AWS SDK env vars are honoured):
AWS_REGION — AWS region (required if not in instance metadata) AWS_ACCESS_KEY_ID — AWS access key (or use instance IAM role) AWS_SECRET_ACCESS_KEY — AWS secret key (or use instance IAM role) AWS_SESSION_TOKEN — optional session token SECRETS_AWS_PREFIX — optional prefix prepended to secret names (default: "vaultrun/")
The secret "DB_PASSWORD" is fetched by secret name "{prefix}DB_PASSWORD". The returned SecretString is used directly.
func NewAWSProvider ¶
func NewAWSProvider(region, prefix string) *AWSProvider
func (*AWSProvider) Name ¶
func (p *AWSProvider) Name() string
type EnvProvider ¶
type EnvProvider struct{}
EnvProvider reads secrets from the server's process environment. Each secret named "FOO" is looked up as VAULTRUN_SECRET_FOO. Ideal for development and single-host deployments.
func (*EnvProvider) Name ¶
func (p *EnvProvider) Name() string
type Provider ¶
type Provider interface {
// GetSecret returns the plaintext value for the named secret.
// Returns an error if the secret does not exist or cannot be fetched.
GetSecret(ctx context.Context, name string) (string, error)
// Name returns a human-readable backend name for diagnostics (never logs secrets).
Name() string
}
Provider is the secrets broker interface.
type Redactor ¶ added in v0.3.4
type Redactor struct {
// contains filtered or unexported fields
}
Redactor removes the exact values of secrets that were injected into a command from its output. It also matches the standard and URL-safe base64 encodings of each value, since `echo $SECRET | base64` is the obvious way to get around a plain match. It cannot catch arbitrary transformations (hex, reversed, split across lines), so it limits accidental leaks; it is not a guarantee against a command that is trying to exfiltrate the value.
func NewRedactor ¶ added in v0.3.4
NewRedactor builds a redactor for the given secret name -> value map. It returns nil when there is nothing to redact; a nil Redactor is valid and is a no-op.
type VaultProvider ¶
type VaultProvider struct {
// contains filtered or unexported fields
}
VaultProvider fetches secrets from a HashiCorp Vault KV v2 mount.
Configuration env vars:
VAULT_ADDR — e.g. "https://vault.example.com" VAULT_TOKEN — Vault token (service account / app role) VAULT_MOUNT — KV v2 mount path (default: "secret") VAULT_PATH — base path inside the mount (default: "vaultrun")
The secret "DB_PASSWORD" is fetched from:
GET {VAULT_ADDR}/v1/{VAULT_MOUNT}/data/{VAULT_PATH}/DB_PASSWORD
and the value at data.data.value is returned.
func NewVaultProvider ¶
func NewVaultProvider(addr, token, mount, path string) *VaultProvider
func (*VaultProvider) Name ¶
func (p *VaultProvider) Name() string
Source Files