Documentation
¶
Overview ¶
Package secrets resolves secret references (`op://...`, `ref+<backend>://...`) against external secret managers.
Index ¶
- Variables
- func ContainsRef(s string) bool
- func HasRef(v any) bool
- func IsRef(s string) bool
- func Kinds() []string
- func Register(kind string, f Factory, aliases ...string)
- type Config
- type Factory
- type Options
- type Provider
- type ProviderConfig
- type Ref
- type ResolveError
- type Resolver
- func (r *Resolver) Close() error
- func (r *Resolver) Redact(s string) string
- func (r *Resolver) Resolve(ctx context.Context, s string) (any, error)
- func (r *Resolver) ResolveEntry(ctx context.Context, props map[string]any) (map[string]any, error)
- func (r *Resolver) ResolveValue(ctx context.Context, v any) (any, error)
Constants ¶
This section is empty.
Variables ¶
var CredentialKeys = []string{
"token", "connect_token", "secret_id", "client_secret", "api_key", "access_key",
"password", "jwt", "credentials_json", "config", "session",
}
CredentialKeys are provider config keys that hold credentials. Their values are redacted like resolved values.
Functions ¶
func ContainsRef ¶
ContainsRef is true when s is a reference or holds an embedded `ref+...+` one.
Types ¶
type Config ¶
type Config map[string]ProviderConfig
Config is the secret_providers block.
func ParseConfig ¶
ParseConfig reads the raw secret_providers block. Each entry needs a `type`.
type Factory ¶
type Factory func(cfg ProviderConfig) (Provider, error)
Factory builds a provider instance from its config.
type Options ¶
type Options struct {
Config Config
CacheTTL time.Duration // 0 keeps values for the process life
Timeout time.Duration // per fetch, default 30s
OnValue func(v string) // called for each resolved value (redaction hook)
BaseDir string // folder for relative `file` paths
// IsSecret tells if the value at a key path is redacted. The path is
// empty when the key is not known. Nil redacts all values.
IsSecret func(path []string) bool
// KeyAliases renames keys of a `from:` object, e.g. username -> user.
KeyAliases map[string]string
}
type Provider ¶
Provider fetches the raw value of one secret. The resolver applies the pointer, trim, cache, and redaction. A provider does none of these.
type ProviderConfig ¶
type ProviderConfig struct {
Name string
Kind string
Props map[string]any // ${VAR} already expanded
// contains filtered or unexported fields
}
ProviderConfig is one entry of secret_providers, or a zero-config default.
func (ProviderConfig) BaseDir ¶
func (c ProviderConfig) BaseDir() string
BaseDir is the folder that relative paths resolve against.
func (ProviderConfig) Bool ¶
func (c ProviderConfig) Bool(key string, envKeys ...string) bool
Bool is Get parsed as a boolean.
func (ProviderConfig) Decode ¶
func (c ProviderConfig) Decode(out any) error
Decode copies Props into a typed struct of the provider (JSON tags).
func (ProviderConfig) Get ¶
func (c ProviderConfig) Get(key string, envKeys ...string) string
Get returns Props[key], else the first set env var of envKeys.
func (ProviderConfig) Redact ¶
func (c ProviderConfig) Redact(s string) string
Redact hides known secret values in s. Use it on CLI stderr and HTTP bodies.
type Ref ¶
type Ref struct {
Raw string // original text, used in errors
Kind string // registry kind after alias mapping, e.g. "op", "awssecrets"
Path string // "prod/postgres"
Params url.Values // backend params, common params removed
Pointer string // "/password", "" for the whole value
Provider string // instance name from ?provider=, "" for default
Trim bool
}
Ref is one parsed secret reference.
func (Ref) Key ¶
Key is the cache key: kind + provider + path + params, without the pointer. Two fields that read different keys of one secret share one fetch.
type ResolveError ¶
ResolveError is the error of one failed reference.
func (*ResolveError) Error ¶
func (e *ResolveError) Error() string
func (*ResolveError) Unwrap ¶
func (e *ResolveError) Unwrap() error
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver turns secret references into values. It is safe for concurrent use.
func NewResolver ¶
func (*Resolver) Resolve ¶
Resolve returns the value for one reference string. A string that is not a reference comes back unchanged. A pointer to an object is an error: objects are valid only in `from:`. Its value is always redacted.
func (*Resolver) ResolveEntry ¶
ResolveEntry is ResolveValue plus the `from:` merge for one connection entry. Keys written in the entry win over keys from the secret.
Source Files
¶
- cli.go
- config.go
- provider.go
- provider_akeyless.go
- provider_aws.go
- provider_azure.go
- provider_bitwarden.go
- provider_conjur.go
- provider_delinea.go
- provider_doppler.go
- provider_exec.go
- provider_file.go
- provider_gcp.go
- provider_http.go
- provider_infisical.go
- provider_k8s.go
- provider_keeper.go
- provider_op.go
- provider_sops.go
- provider_vault.go
- ref.go
- resolver.go
- rest.go