Documentation
¶
Overview ¶
Package secrets resolves secret references in configuration through an omnivault vault.
A Resolver expands ${NAME} and $NAME references the way os.ExpandEnv does, except that each NAME is read from a vault instead of the process environment. The default resolver (Env) is backed by omnivault's environment provider and behaves exactly like os.ExpandEnv: a reference to a missing secret expands to the empty string.
Any other vault plugs in through New (an omnivault.Vault the deployment built itself) or FromURI (an omnivault URI such as env://, file:///dir, or a scheme a cloud provider package registered with omnivault.RegisterProvider). SystemForge itself imports no cloud SDK: a deployment that keeps its secrets in, say, AWS Secrets Manager imports that provider's registration package in its own main package.
Errors other than "secret not found" (an unreachable vault, a permission error) are returned, never treated as an empty value.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func WholeReference ¶
WholeReference reports whether s is entirely one ${NAME} reference and returns NAME.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver reads secret values from an omnivault vault.
func Env ¶
func Env() *Resolver
Env returns a resolver backed by the process environment, the default: Expand then behaves exactly like os.ExpandEnv.
func FromURI ¶
FromURI returns a resolver backed by the vault omnivault.VaultFromURI opens for uri (env://, file:///dir, memory://, or a scheme registered with omnivault.RegisterProvider). Close closes the vault.
func (*Resolver) Expand ¶
Expand replaces ${NAME} and $NAME references in s with the secrets they name, with os.Expand's syntax; a missing secret expands to the empty string. It returns the first vault error.
func (*Resolver) ExpandWhole ¶
ExpandWhole is Expand for values that may hold arbitrary data, such as PEM keys: a value that is entirely one ${NAME} reference (surrounding space ignored) is replaced by the secret without re-scanning it, so a "$" inside the secret is kept. Anything else goes through Expand.
Source Files