Documentation
¶
Overview ¶
Package secrets implements the client-side Podplane Secrets aggregated API calls used by `podplane secret`.
Index ¶
- Constants
- func AssociatedData(opts WriteOptions) []byte
- func DecodePublicKey(value string) ([]byte, error)
- func EncryptWriteValue(recipient string, plaintext, associatedData []byte) (string, error)
- func IsStalePublicKeyError(err error) bool
- func KeyspaceName(provider, spc string) string
- func ResolveProvider(summary config.ClusterSummary, requested string) (string, error)
- func SummaryHasProvider(summary config.ClusterSummary, provider string) bool
- func ValidateKey(key string) error
- func ValidateProviderName(provider string) error
- func ValidateScopeName(name, value string) error
- type Client
- func (c Client) Delete(namespace, keyspaceName, key string, destroy bool) error
- func (c Client) EncryptedRequest(opts WriteOptions) (SecretProviderKeyspace, error)
- func (c Client) Get(namespace, keyspaceName string) (SecretProviderKeyspace, error)
- func (c Client) PublicKey() (PublicKey, error)
- func (c Client) Put(keyspace SecretProviderKeyspace) (SecretProviderKeyspace, error)
- func (c Client) PutEncrypted(request SecretProviderKeyspace, opts WriteOptions) (SecretProviderKeyspace, error)
- type EncryptedValue
- type EntryRequest
- type EntryStatus
- type KeyspaceMeta
- type KeyspaceSpec
- type KeyspaceStatus
- type PublicKey
- type PublicKeySpec
- type SecretProviderKeyspace
- type WriteOptions
Constants ¶
const (
// APIGroupVersion is the Podplane Secrets aggregated API group/version.
APIGroupVersion = "secrets-api.podplane.dev/v1beta1"
)
const Algorithm = "x25519-hkdf-sha256-aes-256-gcm"
Algorithm is the supported client-side write encryption algorithm.
Variables ¶
This section is empty.
Functions ¶
func AssociatedData ¶
func AssociatedData(opts WriteOptions) []byte
AssociatedData returns the AES-GCM associated data for one secret value.
func DecodePublicKey ¶
DecodePublicKey accepts padded standard base64 or unpadded base64url public keys.
func EncryptWriteValue ¶
EncryptWriteValue encrypts one secret write value for the operator public key.
func IsStalePublicKeyError ¶
IsStalePublicKeyError reports whether an API error indicates key rotation.
func KeyspaceName ¶
KeyspaceName returns the SecretProviderKeyspace name for provider and binding/SPC.
func ResolveProvider ¶
func ResolveProvider(summary config.ClusterSummary, requested string) (string, error)
ResolveProvider returns the requested secrets provider or the cluster default.
func SummaryHasProvider ¶
func SummaryHasProvider(summary config.ClusterSummary, provider string) bool
SummaryHasProvider reports whether the cached cluster summary includes provider.
func ValidateKey ¶
ValidateKey validates a Podplane secret key name.
func ValidateProviderName ¶
ValidateProviderName validates a configured secrets provider name.
func ValidateScopeName ¶
ValidateScopeName validates a namespace or SecretProviderClass scope name.
Types ¶
type Client ¶
Client shells out to kubectl so aggregated API calls use the user's normal kubeconfig credentials and auth plugins.
func (Client) EncryptedRequest ¶
func (c Client) EncryptedRequest(opts WriteOptions) (SecretProviderKeyspace, error)
EncryptedRequest builds an encrypted SecretProviderKeyspace write request.
func (Client) Get ¶
func (c Client) Get(namespace, keyspaceName string) (SecretProviderKeyspace, error)
Get returns metadata for one provider/SPC boundary.
func (Client) Put ¶
func (c Client) Put(keyspace SecretProviderKeyspace) (SecretProviderKeyspace, error)
Put sends a named SecretProviderKeyspace update.
func (Client) PutEncrypted ¶
func (c Client) PutEncrypted(request SecretProviderKeyspace, opts WriteOptions) (SecretProviderKeyspace, error)
PutEncrypted sends an encrypted write request and retries once after key rotation.
type EncryptedValue ¶
type EncryptedValue struct {
KeyID string `json:"keyID" yaml:"keyID"`
Algorithm string `json:"algorithm" yaml:"algorithm"`
Ciphertext string `json:"ciphertext" yaml:"ciphertext"`
}
EncryptedValue carries client-side encrypted secret material.
type EntryRequest ¶
type EntryRequest struct {
Key string `json:"key" yaml:"key"`
Operation string `json:"operation" yaml:"operation"`
EncryptedValue *EncryptedValue `json:"encryptedValue,omitempty" yaml:"encryptedValue,omitempty"`
}
EntryRequest is one SecretProviderKeyspace entry operation.
type EntryStatus ¶
type EntryStatus struct {
Key string `json:"key" yaml:"key"`
Status string `json:"status" yaml:"status"`
BackendPath string `json:"backendPath,omitempty" yaml:"backendPath,omitempty"`
RestoreUntil string `json:"restoreUntil,omitempty" yaml:"restoreUntil,omitempty"`
}
EntryStatus is one metadata-only backend key status.
type KeyspaceMeta ¶
type KeyspaceMeta struct {
Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
Name string `json:"name" yaml:"name"`
}
KeyspaceMeta identifies a SecretProviderKeyspace resource.
type KeyspaceSpec ¶
type KeyspaceSpec struct {
Entries []EntryRequest `json:"entries" yaml:"entries"`
}
KeyspaceSpec contains requested entry operations.
type KeyspaceStatus ¶
type KeyspaceStatus struct {
Provider string `json:"provider,omitempty" yaml:"provider,omitempty"`
Entries []EntryStatus `json:"entries,omitempty" yaml:"entries,omitempty"`
}
KeyspaceStatus contains backend-derived metadata only.
type PublicKey ¶
type PublicKey struct {
APIVersion string `json:"apiVersion,omitempty" yaml:"apiVersion,omitempty"`
Kind string `json:"kind,omitempty" yaml:"kind,omitempty"`
Metadata struct {
Name string `json:"name,omitempty" yaml:"name,omitempty"`
} `json:"metadata,omitempty" yaml:"metadata,omitempty"`
Spec PublicKeySpec `json:"spec" yaml:"spec"`
}
PublicKey is the Kubernetes-style public key object returned by the operator.
type PublicKeySpec ¶
type PublicKeySpec struct {
KeyID string `json:"keyID" yaml:"keyID"`
CreatedAt string `json:"createdAt,omitempty" yaml:"createdAt,omitempty"`
Algorithm string `json:"algorithm" yaml:"algorithm"`
PublicKey string `json:"publicKey" yaml:"publicKey"`
}
PublicKeySpec describes the current operator encryption public key.
type SecretProviderKeyspace ¶
type SecretProviderKeyspace struct {
APIVersion string `json:"apiVersion" yaml:"apiVersion"`
Kind string `json:"kind" yaml:"kind"`
Metadata KeyspaceMeta `json:"metadata" yaml:"metadata"`
Spec *KeyspaceSpec `json:"spec,omitempty" yaml:"spec,omitempty"`
Status KeyspaceStatus `json:"status,omitempty" yaml:"status,omitempty"`
}
SecretProviderKeyspace is the Kubernetes-style SecretProviderKeyspace object.
func NewKeyspaceRequest ¶
func NewKeyspaceRequest(namespace, keyspaceName, key, operation string, encrypted *EncryptedValue) SecretProviderKeyspace
NewKeyspaceRequest builds a one-entry SecretProviderKeyspace request.
Source Files