Documentation
¶
Overview ¶
Package secretgen mints the secret values a project declares as generated: random key material, passwords that satisfy a complexity policy, and key pairs and certificates.
A Spec names a Kind, the secret names the result is stored under, and the kind's parameters. Generate turns it into Values (name to string) and either returns every value or none. Mint is the create-only write on top: it generates and stores a value only when the store holds none, so re-running it, from a converge Job or a promotion, never rotates a live secret.
Kinds ¶
KindRandom Bytes of randomness, hex or base64, with an optional prefix. 1 name KindPassword Letters, digits and symbols, with at least one of each class. 1 name KindECP256PKCS8 An EC P-256 private key, PKCS#8 PEM. 1 name KindRSA2048 An RSA 2048 private key (PKCS#8 PEM), then its public key. 2 names KindECP256SelfSigned An EC P-256 private key (PKCS#8 PEM), then a self-signed cert. 2 names
For a two-name kind, Names are in the order of the table: the private key first. The pair always comes from one generation, never one half from each of two runs; Mint refuses to fill in the missing half of a pair (see ErrPartial) because that half could not match the one already stored.
Randomness ¶
Everything comes from crypto/rand. The Random and Password kinds read from Options.Rand so tests can pin the stream; key generation always uses the system source, because Go's key generators ignore a caller's reader.
Consuming it ¶
Mint declares the two-method Store it needs. A KV-v2 client with a check-and-set write satisfies it with a thin adapter.
Index ¶
Constants ¶
const ( DefaultBytes = 32 DefaultEncoding = "base64" DefaultLength = 32 DefaultSymbols = "!-_." DefaultValidFor = 3700 * 24 * time.Hour MaxBytes = 1024 MinPasswordLen = 8 MaxPasswordLen = 1024 )
Defaults applied when a parameter is left zero.
Variables ¶
var ErrPartial = errors.New("secretgen: only some of the spec's names exist")
ErrPartial reports that some of a spec's names exist in the store and others do not. The missing ones are not generated: they could not match the ones already stored (a private key from one run, its certificate from another). Delete the leftover names and mint again.
Functions ¶
func Mint ¶
Mint stores the spec's values unless they are already there.
- Every name exists: nothing is generated or written; created is false.
- No name exists: the spec is generated and written in Names order. Losing the race for the first name means another writer minted it, and Mint writes nothing further and returns created = false.
- Some names exist: ErrPartial.
A failure after the first name was written leaves a partial pair, which the next Mint reports as ErrPartial.
Types ¶
type Options ¶
type Options struct {
// Rand feeds KindRandom and KindPassword. Keys never use it.
Rand io.Reader
// Now stamps certificates.
Now func() time.Time
}
Options injects the nondeterministic inputs. The zero value uses crypto/rand and the wall clock.
type Spec ¶
type Spec struct {
Kind Kind
// Names are the secret names the result is stored under, one per output of
// the kind, in the order the package doc lists.
Names []string
// KindRandom: Bytes of randomness (default 32, at most 1024), written in
// Encoding ("base64" standard, the default, or "hex"), after Prefix.
Bytes int
Encoding string
Prefix string
// KindPassword: Length characters (default 32; 8 to 1024) with at least one
// upper-case letter, lower-case letter, digit and symbol. Symbols is the
// symbol alphabet (default "!-_."), drawn from "!#%*+-.:=@^_~".
Length int
Symbols string
// KindECP256SelfSigned: the certificate's subject CommonName (required) and
// lifetime (default 3700 days).
CommonName string
ValidFor time.Duration
}
Spec declares one generated value (or one atomic pair).
type Store ¶
type Store interface {
// Exists reports whether a value is stored under name.
Exists(ctx context.Context, name string) (bool, error)
// CreateOnly stores value under name only if nothing is stored there (a
// KV-v2 check-and-set of 0) and reports whether it did. Losing that race
// is not an error: it returns false.
CreateOnly(ctx context.Context, name, value string) (created bool, err error)
}
Store is the create-only access Mint needs.
Source Files