encryption

Mar 7, 2026

Changes in this version

+ const DefaultEncryptionKeySecretKey

+ const DefaultEncryptionKeySecretName

+ const KeySize

+ const NonceSize

+ const RadiusNamespace

+ var ErrAssociatedDataMismatch = errors.New("associated data mismatch")

+ var ErrDecryptionFailed = errors.New("decryption failed")

+ var ErrEmptyPlaintext = errors.New("plaintext cannot be empty")

+ var ErrEncryptionFailed = errors.New("encryption failed")

+ var ErrFieldDecryptionFailed = errors.New("field decryption failed")

+ var ErrFieldEncryptionFailed = errors.New("field encryption failed")

+ var ErrFieldNotFound = errors.New("field not found")

+ var ErrInvalidEncryptedData = errors.New("invalid encrypted data format")

+ var ErrInvalidFieldPath = errors.New("invalid field path")

+ var ErrInvalidKeySize = errors.New("encryption key must be 32 bytes (256 bits)")

+ var ErrKeyLoadFailed = errors.New("failed to load encryption key")

+ var ErrKeyNotFound = errors.New("encryption key not found")

+ var ErrKeyVersionNotFound = errors.New("key version not found")

+ func GenerateKey() ([]byte, error)

+ func GetEncryptedDataVersion(data []byte) (int, error)

+ func IsEncryptedData(data []byte) bool

+ type EncryptedData struct

+ AD string

+ Encrypted string

+ Nonce string

+ Version int

+ type Encryptor struct

+ func NewEncryptor(key []byte) (*Encryptor, error)

+ func NewEncryptorWithVersion(key []byte, version int) (*Encryptor, error)

+ func (e *Encryptor) Decrypt(data []byte, associatedData []byte) ([]byte, error)

+ func (e *Encryptor) DecryptString(data string, associatedData []byte) (string, error)

+ func (e *Encryptor) Encrypt(plaintext []byte, associatedData []byte) ([]byte, error)

+ func (e *Encryptor) EncryptString(plaintext string, associatedData []byte) (string, error)

+ type InMemoryKeyProvider struct

+ func NewInMemoryKeyProvider(key []byte) (*InMemoryKeyProvider, error)

+ func NewInMemoryKeyProviderWithVersions(keys map[int][]byte, currentVersion int) (*InMemoryKeyProvider, error)

+ func (p *InMemoryKeyProvider) AddKey(version int, key []byte) error

+ func (p *InMemoryKeyProvider) GetCurrentKey(ctx context.Context) ([]byte, int, error)

+ func (p *InMemoryKeyProvider) GetKeyByVersion(ctx context.Context, version int) ([]byte, error)

+ func (p *InMemoryKeyProvider) SetCurrentVersion(version int) error

+ type KeyData struct

+ CreatedAt string

+ ExpiresAt string

+ Key string

+ Version int

+ type KeyProvider interface

+ GetCurrentKey func(ctx context.Context) (key []byte, version int, err error)

+ GetKeyByVersion func(ctx context.Context, version int) ([]byte, error)

+ type KeyStore struct

+ CurrentVersion int

+ Keys map[string]KeyData

+ type KubernetesKeyProvider struct

+ func NewKubernetesKeyProvider(client controller_runtime.Client, opts *KubernetesKeyProviderOptions) *KubernetesKeyProvider

+ func (p *KubernetesKeyProvider) GetCurrentKey(ctx context.Context) ([]byte, int, error)

+ func (p *KubernetesKeyProvider) GetKeyByVersion(ctx context.Context, version int) ([]byte, error)

+ type KubernetesKeyProviderOptions struct

+ Namespace string

+ SecretKey string

+ SecretName string

+ type MockKeyProvider struct

+ func NewMockKeyProvider(ctrl *gomock.Controller) *MockKeyProvider

+ func (m *MockKeyProvider) EXPECT() *MockKeyProviderMockRecorder

+ func (m *MockKeyProvider) GetCurrentKey(arg0 context.Context) ([]byte, int, error)

+ func (m *MockKeyProvider) GetKeyByVersion(arg0 context.Context, arg1 int) ([]byte, error)

+ type MockKeyProviderGetCurrentKeyCall struct

+ func (c *MockKeyProviderGetCurrentKeyCall) Do(f func(context.Context) ([]byte, int, error)) *MockKeyProviderGetCurrentKeyCall

+ func (c *MockKeyProviderGetCurrentKeyCall) DoAndReturn(f func(context.Context) ([]byte, int, error)) *MockKeyProviderGetCurrentKeyCall

+ func (c *MockKeyProviderGetCurrentKeyCall) Return(arg0 []byte, arg1 int, arg2 error) *MockKeyProviderGetCurrentKeyCall

+ type MockKeyProviderGetKeyByVersionCall struct

+ func (c *MockKeyProviderGetKeyByVersionCall) Do(f func(context.Context, int) ([]byte, error)) *MockKeyProviderGetKeyByVersionCall

+ func (c *MockKeyProviderGetKeyByVersionCall) DoAndReturn(f func(context.Context, int) ([]byte, error)) *MockKeyProviderGetKeyByVersionCall

+ func (c *MockKeyProviderGetKeyByVersionCall) Return(arg0 []byte, arg1 error) *MockKeyProviderGetKeyByVersionCall

+ type MockKeyProviderMockRecorder struct

+ func (mr *MockKeyProviderMockRecorder) GetCurrentKey(arg0 any) *MockKeyProviderGetCurrentKeyCall

+ func (mr *MockKeyProviderMockRecorder) GetKeyByVersion(arg0, arg1 any) *MockKeyProviderGetKeyByVersionCall

+ type SensitiveDataHandler struct

+ func NewSensitiveDataHandler(encryptor *Encryptor) *SensitiveDataHandler

+ func NewSensitiveDataHandlerFromKey(key []byte) (*SensitiveDataHandler, error)

+ func NewSensitiveDataHandlerFromProvider(ctx context.Context, provider KeyProvider) (*SensitiveDataHandler, error)

+ func (h *SensitiveDataHandler) DecryptSensitiveFields(ctx context.Context, data map[string]any, sensitiveFieldPaths []string, ...) error

+ func (h *SensitiveDataHandler) DecryptSensitiveFieldsWithSchema(ctx context.Context, data map[string]any, sensitiveFieldPaths []string, ...) error

+ func (h *SensitiveDataHandler) EncryptSensitiveFields(data map[string]any, sensitiveFieldPaths []string, resourceID string) error