ekm

package

v1.46.0 Latest Latest Go to latest Published: Dec 22, 2025 License: Apache-2.0 Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/open-policy-agent/eopa

Links

README ¶

EKM - External Key Manager Plugin

The EKM plugin manages passwords with Vault or other external key manager

Download development server:

brew tap hashicorp/tap
brew install hashicorp/tap/vault

# start vault 'dev' server (http)
vault server -dev -dev-root-token-id="dev-only-token"

# add a license key to vault secrets
export VAULT_TOKEN=dev-only-token
export VAULT_ADDR='http://127.0.0.1:8200'

vault kv put -mount=secret license key=<key>
vault kv put -mount=secret acmecorp/bearer token=test123 scheme=Bearer
vault kv put -mount=secret acmecorp "url=https://www.acmecorp.com"
vault kv put -mount=secret rsa key=public1
vault kv put -mount=secret tls/bearer token=test123 scheme=Bearer

# test vault logical read
vault read secret/data/license

Run

eopa --config-file testdata/ekm.yaml run -s -l debug

Documentation ¶

Constants ¶

View Source

const Name = "ekm"

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Config ¶

type Config struct {
	Vault *VaultConfig `json:"vault,omitempty"`
}

type EKM ¶

type EKM struct {
	// contains filtered or unexported fields
}

func NewEKM ¶

func NewEKM() *EKM

func (*EKM) OnConfig ¶

func (e *EKM) OnConfig(ctx context.Context, conf *config.Config) (*config.Config, error)

func (*EKM) OnConfigDiscovery ¶

func (e *EKM) OnConfigDiscovery(ctx context.Context, conf *config.Config) (*config.Config, error)

func (*EKM) SetLogger ¶

func (e *EKM) SetLogger(l logging.Logger)

type K8sAuth ¶

type K8sAuth struct {
	ServiceToken string `json:"service_token,omitempty"`
}

type RoleAuth ¶

type RoleAuth struct {
	RoleID   string `json:"role_id,omitempty"`
	SecretID string `json:"secret_id,omitempty"`
	Wrapped  bool   `json:"wrapped,omitempty"`
}

type VaultConfig ¶

type VaultConfig struct {
	URL        string    `json:"url"`
	Insecure   bool      `json:"insecure"`
	RootCA     string    `json:"rootca"`
	AccessType string    `json:"access_type"`
	Token      string    `json:"token,omitempty"`
	TokenFile  string    `json:"token_file,omitempty"`
	AppRole    *RoleAuth `json:"approle,omitempty"`
	K8sService *K8sAuth  `json:"kubernetes,omitempty"`

	// override mappings
	License  map[string]string         `json:"license,omitempty"`
	Keys     map[string]string         `json:"keys,omitempty"`
	Services map[string]string         `json:"services,omitempty"`
	HTTPSend map[string]map[string]any `json:"httpsend,omitempty"`
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL