Documentation
¶
Overview ¶
Package secrets resolves CUE recipe secret refs.
Recipe values must be symmetric: secure:v1:<nonce-b64>:<ciphertext-b64>. The stack data key comes from honey defaults.secretsprovider + defaults.encryptedkey (or SymmetricDataKey in tests), unwrapped via stackunwrap.DataKeyUnwrapper providers:
- gcpkms://projects/…/locations/…/keyRings/…/cryptoKeys/… — encryptedkey is KMS ciphertext (base64)
- awskms:// — encryptedkey is base64 KMS ciphertext blob
- vault-transit://mount/keyName — encryptedkey is transit ciphertext
- k8s://namespace/secretName — encryptedkey is Secret data key name (32 raw bytes or base64)
- keyring://service/user — OS keyring holds the data key (base64 or raw)
- age:// — encryptedkey is armored age ciphertext (requires AgeIdentityFile)
- age-file://path — ciphertext file on disk (requires AgeIdentityFile)
Authoring: honey secrets keyring-init (local OS keyring), honey secrets seal, and honey secrets unseal for recipe secure:v1 values with the same stack key as runtime resolution.
Index ¶
- func FormatKeyringStackKeyValue(key []byte) (string, error)
- func GenerateStackDataKey() ([]byte, error)
- func KeyringConfigSnippet(providerURL string) string
- func KeyringEntryExists(service, user string) (bool, error)
- func KeyringProviderURL(service, user string) string
- func RecipeDirFrom(ctx context.Context) string
- func ResolveStackDataKey(ctx context.Context, opts Options) ([]byte, error)
- func Seal(ctx context.Context, opts Options, plaintext string) (string, error)
- func StoreStackDataKeyInKeyring(service, user string, key []byte) error
- func Unseal(ctx context.Context, opts Options, ref string) (string, error)
- func WithRecipeDir(ctx context.Context, absDir string) context.Context
- type Manager
- type MockResolver
- type Options
- type Resolver
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FormatKeyringStackKeyValue ¶
FormatKeyringStackKeyValue encodes a 32-byte stack key for OS keyring storage.
func GenerateStackDataKey ¶
GenerateStackDataKey returns a random 32-byte AES stack key.
func KeyringConfigSnippet ¶
KeyringConfigSnippet returns YAML defaults for a keyring stack provider.
func KeyringEntryExists ¶
KeyringEntryExists reports whether keyring.Get succeeds for service/user.
func KeyringProviderURL ¶
KeyringProviderURL returns the secretsprovider value for keyring://service/user.
func RecipeDirFrom ¶
RecipeDirFrom returns the directory set by WithRecipeDir, or empty.
func ResolveStackDataKey ¶
ResolveStackDataKey returns the 32-byte AES stack key from opts (static test key or registry unwrap).
func StoreStackDataKeyInKeyring ¶
StoreStackDataKeyInKeyring writes key to the OS credential store (base64-encoded).
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager coordinates resolution across multiple ref.Backend instances (analogous to
func NewManager ¶
NewManager builds a manager from an explicit backend list (tests may inject mocks).
type MockResolver ¶
MockResolver is a fixed-value resolver for tests .
type Options ¶
type Options struct {
// SymmetricDataKey, when exactly [stack.SymmetricKeyBytes] long, decrypts secure:v1 without KMS (tests).
SymmetricDataKey []byte
// SecretsProvider and EncryptedKey unwrap the stack data key (e.g. gcpkms://…, age://…).
SecretsProvider string
EncryptedKey string
// AgeIdentityFile enables age:// and age-file:// stack providers and loads age identities.
AgeIdentityFile string
// ExtraBackends append plugin or test secret backends after built-in wiring.
ExtraBackends []ref.Backend
}
Options configures stack data-key unwrap and optional symmetric test keys.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package cloud resolves cloud and enterprise secret refs (Vault, AWS), analogous to
|
Package cloud resolves cloud and enterprise secret refs (Vault, AWS), analogous to |
|
Package env resolves env:NAME refs from the process environment (local analogue of cloud:/aws-sm:/aws-kms:/k8s:/age:/age-b64:/age-file:/keyring:/vault).
|
Package env resolves env:NAME refs from the process environment (local analogue of cloud:/aws-sm:/aws-kms:/k8s:/age:/age-b64:/age-file:/keyring:/vault). |
|
Package k8s resolves Kubernetes Secret data keys.
|
Package k8s resolves Kubernetes Secret data keys. |
|
Package passphrase resolves age-encrypted material.
|
Package passphrase resolves age-encrypted material. |
|
Package ref holds shared contracts for recipe secret backends (similar in role to how honey centralizes crypto provider contracts).
|
Package ref holds shared contracts for recipe secret backends (similar in role to how honey centralizes crypto provider contracts). |
|
Package service resolves keyring:// refs via the OS credential store (Zalando keyring), analogous to cloud:/aws-sm:/aws-kms:/k8s:/age:/age-b64:/age-file:/keyring:/vault.
|
Package service resolves keyring:// refs via the OS credential store (Zalando keyring), analogous to cloud:/aws-sm:/aws-kms:/k8s:/age:/age-b64:/age-file:/keyring:/vault. |
|
Package stack implements symmetric secure:v1 encryption for recipe secrets.
|
Package stack implements symmetric secure:v1 encryption for recipe secrets. |
|
Package stackunwrap unwraps stack data keys from secretsprovider URLs (KMS, keyring, age, etc.).
|
Package stackunwrap unwraps stack data keys from secretsprovider URLs (KMS, keyring, age, etc.). |