Documentation
¶
Overview ¶
Package stackunwrap unwraps stack data keys from secretsprovider URLs (KMS, keyring, age, etc.).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecodeKeyringMaterial ¶
DecodeKeyringMaterial reads a keyring value (base64 or legacy raw 32 bytes).
func EncodeKeyringMaterial ¶
EncodeKeyringMaterial stores a stack data key as standard base64 for OS keyrings.
Types ¶
type AWSKMS ¶
type AWSKMS struct{}
AWSKMS unwraps a data key via awskms:// (encryptedkey is base64 ciphertext blob).
func (AWSKMS) Supports ¶
Supports implements DataKeyUnwrapper.
type Age ¶
type Age struct {
IdentityFile string
}
Age unwraps a stack data key using age identities from identityFile. secretsprovider age:// — armored ciphertext in encryptedkey. secretsprovider age-file://path — ciphertext read from path (encryptedkey ignored).
func (Age) Supports ¶
Supports implements DataKeyUnwrapper.
type DataKeyUnwrapper ¶
type DataKeyUnwrapper interface {
Name() string
Supports(providerURL string) bool
Unwrap(ctx context.Context, providerURL, encryptedKey string) ([]byte, error)
}
DataKeyUnwrapper unwraps a stack data key from defaults.secretsprovider + defaults.encryptedkey.
type GCPKMS ¶
type GCPKMS struct{}
GCPKMS unwraps a data key via gcpkms://projects/…/cryptoKeys/….
func (GCPKMS) Supports ¶
Supports implements DataKeyUnwrapper.
type K8s ¶
type K8s struct{}
K8s loads the stack data key from a Kubernetes Secret data field. secretsprovider: k8s://namespace/secretName encryptedkey: data key name (value is raw 32 bytes or base64).
func (K8s) Supports ¶
Supports implements DataKeyUnwrapper.
type Keyring ¶
type Keyring struct{}
Keyring loads the stack data key from the OS credential store. secretsprovider: keyring://service/user (encryptedkey is ignored).
func (Keyring) Supports ¶
Supports implements DataKeyUnwrapper.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry dispatches stack data-key unwrap to registered providers.
func (*Registry) Register ¶
func (r *Registry) Register(p DataKeyUnwrapper)
Register appends a provider (first match wins).
type VaultTransit ¶
type VaultTransit struct{}
VaultTransit decrypts the stack data key via Vault Transit. secretsprovider: vault-transit://mount/keyName encryptedkey: transit ciphertext (vault:v1:… or raw).
func (VaultTransit) Supports ¶
func (VaultTransit) Supports(providerURL string) bool
Supports implements DataKeyUnwrapper.
Source Files