Documentation
¶
Overview ¶
Package secrets provides encrypted secret storage using pluggable backends.
Index ¶
- Constants
- func CalculateChecksum(data []byte) string
- func DecryptData(encryptedData, key []byte) ([]byte, error)
- func DecryptDataWithAlgorithm(encryptedData, key []byte, algorithm string) ([]byte, error)
- func DecryptDataWithMultipleKeys(encryptedData []byte, keys [][]byte) ([]byte, error)
- func EncryptData(plaintext, key []byte) ([]byte, error)
- func EncryptDataWithAlgorithm(plaintext, key []byte, algorithm string) ([]byte, error)
- func GenerateKeyID() (string, error)
- func LoadEncryptionKeys(ctx context.Context, keys ...KeyConfig) ([][]byte, error)
- type AWSSecretsManager
- type Cached
- type GCPSecretManager
- func (g *GCPSecretManager) Delete(ctx context.Context, name string) error
- func (g *GCPSecretManager) Get(ctx context.Context, name string) ([]byte, error)
- func (g *GCPSecretManager) List(ctx context.Context) ([]string, error)
- func (g *GCPSecretManager) Set(ctx context.Context, name string, data []byte) error
- type KeyConfig
- type Memory
- type ObjectStorageStore
- type Store
- type StoreOptions
Constants ¶
const ( // AESKeySize is the size of AES keys we use (256-bit) AESKeySize = 32 // NonceSize is the size of the nonce/IV for AES-GCM NonceSize = 12 )
Variables ¶
This section is empty.
Functions ¶
func CalculateChecksum ¶
CalculateChecksum calculates SHA256 checksum of data
func DecryptData ¶
DecryptData decrypts data using AES-GCM with the given encryption key
func DecryptDataWithAlgorithm ¶
DecryptDataWithAlgorithm decrypts data with specific algorithm info
func DecryptDataWithMultipleKeys ¶
DecryptDataWithMultipleKeys tries to decrypt data with multiple encryption keys
func EncryptData ¶
EncryptData encrypts data using AES-GCM with the given encryption key
func EncryptDataWithAlgorithm ¶
EncryptDataWithAlgorithm encrypts data with specific algorithm info
func GenerateKeyID ¶
GenerateKeyID generates a unique identifier for a key
func LoadEncryptionKeys ¶
LoadEncryptionKeys loads all encryption keys from the given configs. Note that the first key will be the current encryption key, and any additional keys will be old keys used only for decryption.
Types ¶
type AWSSecretsManager ¶
type AWSSecretsManager struct {
// contains filtered or unexported fields
}
AWSSecretsManager implements Store using AWS Secrets Manager
func NewAWSSecretsManagerStore ¶
func NewAWSSecretsManagerStore(client *secretsmanager.Client, prefix string) *AWSSecretsManager
NewAWSSecretsManagerStore creates a new AWS Secrets Manager store
func (*AWSSecretsManager) Delete ¶
func (a *AWSSecretsManager) Delete(ctx context.Context, name string) error
Delete removes a secret from AWS Secrets Manager
type Cached ¶
type Cached struct {
// contains filtered or unexported fields
}
Cached wraps a Store with in-memory caching and stale-while-revalidate strategy
type GCPSecretManager ¶
type GCPSecretManager struct {
// contains filtered or unexported fields
}
GCPSecretManager implements secrets Store using GCP Secret Manager
func NewGCPSecretManagerStore ¶
func NewGCPSecretManagerStore(client *secretmanager.Client, project, prefix string) *GCPSecretManager
NewGCPSecretManagerStore creates a new GCP Secret Manager store
func (*GCPSecretManager) Delete ¶
func (g *GCPSecretManager) Delete(ctx context.Context, name string) error
Delete removes a secret from GCP Secret Manager
type Memory ¶
type Memory struct {
// contains filtered or unexported fields
}
Memory implements Store using in-memory storage
type ObjectStorageStore ¶
type ObjectStorageStore struct {
// contains filtered or unexported fields
}
ObjectStorageStore implements Store using object storage (S3, GCS, etc.) with optional encryption
func NewObjectStorageStore ¶
func NewObjectStorageStore(storage storage.Storage, prefix string, encryptionKeys [][]byte) *ObjectStorageStore
NewObjectStorageStore creates a new object storage-based store with optional encryption keys
func (*ObjectStorageStore) Delete ¶
func (s *ObjectStorageStore) Delete(ctx context.Context, name string) error
Delete removes a secret from object storage
type Store ¶
type Store interface {
Get(ctx context.Context, name string) ([]byte, error)
Set(ctx context.Context, name string, data []byte) error
Delete(ctx context.Context, name string) error
}
Store provides simple secret storage operations
func NewCachedStore ¶
NewCachedStore creates a new cached store wrapper
type StoreOptions ¶
type StoreOptions struct {
Provider string
Prefix string
CacheTTL time.Duration
EncryptionKeys []KeyConfig // Only used for object-storage provider
GCPProject string // Required for gcp-secret-manager provider
Storage storage.Storage
}
StoreOptions contains configuration for creating a secrets Store
Source Files