imds

package
v1.11.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 6, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Overview

Package imds harvests credentials from cloud instance-metadata services (AWS IMDS, GCP/Azure metadata, Kubernetes in-cluster SA, Alibaba, DigitalOcean, OCI) and normalizes each into a synthetic dotenv blob that geiger's normal recognizers pick up. The metadata fetch is the only place geiger bypasses the SSRF dial guard (see client.go); every harvested credential is then triaged through the unchanged, guarded recon pipeline.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Cred 

type Cred struct {
	Cloud  string // "aws" | "gcp" | "azure" | "kubernetes" | "alibaba" | "digitalocean" | "oci"
	Label  string // provenance, e.g. "metadata: aws instance role ec2-app"
	Blob   string // synthetic dotenv text the recognizers consume
	Secret string // raw secret value (for redaction)
}

Cred is one harvested credential, expressed as a synthetic dotenv blob plus a provenance label, so the standard pipeline (parse.Parse → recognize.Recognize → recon) triages it through the matching module.

func Harvest 

func Harvest(ctx context.Context, o Options) (creds []Cred, clouds []string, err error)

Harvest probes every supported provider concurrently (absent endpoints time out quietly) and returns the credentials it could read plus the clouds that responded. It never returns secrets in the error or cloud list.

type Options 

type Options struct {
	Timeout time.Duration // per-provider probe timeout (default 2s)
}

Options configures a harvest.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.