Documentation
¶
Index ¶
- func IsCacheable(expr string) bool
- func NormalizeExpression(expr string) (string, bool)
- func NormalizeLegacyBraces(value string) string
- type DeferredError
- type MockProvider
- type OnePasswordCLIProvider
- type OnePasswordSDKProvider
- type Provider
- type Resolver
- type SecretRef
- type Shims
- type SopsProvider
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsCacheable ¶ added in v0.9.0
IsCacheable reports whether an expression is a standalone secret reference eligible for TF_VAR cache reuse.
func NormalizeExpression ¶ added in v0.9.0
NormalizeExpression takes any supported secret notation and returns the equivalent secret("vault","item","field") function call string. Returns the original string and false if the input is not a secret reference.
Handles:
"secret.op.vault.item.field" -> secret("vault","item","field")
"secrets.op.vault.item.field" -> secret("vault","item","field")
"secret.sops.key.path" -> secret("sops","key.path","")
"op.vault.item.field" -> secret("vault","item","field")
"sops.key.path" -> secret("sops","key.path","")
"secret(\"v\",\"i\",\"f\")" -> unchanged (already canonical)
func NormalizeLegacyBraces ¶ added in v0.9.0
NormalizeLegacyBraces converts ${{ expr }} to ${ expr }.
Types ¶
type DeferredError ¶ added in v0.9.0
DeferredError signals that a secret expression should be preserved for later evaluation. This is not an error condition but a control-flow signal.
func (*DeferredError) Error ¶ added in v0.9.0
func (e *DeferredError) Error() string
type MockProvider ¶ added in v0.9.0
type MockProvider struct {
LoadSecretsFunc func() error
ResolveFunc func(ref SecretRef) (string, bool, error)
}
MockProvider is a mock implementation of the Provider interface for testing.
func NewMockProvider ¶ added in v0.9.0
func NewMockProvider() *MockProvider
NewMockProvider creates a new MockProvider instance.
func (*MockProvider) LoadSecrets ¶ added in v0.9.0
func (m *MockProvider) LoadSecrets() error
LoadSecrets calls the mock LoadSecretsFunc if set, otherwise returns nil.
type OnePasswordCLIProvider ¶ added in v0.9.0
type OnePasswordCLIProvider struct {
// contains filtered or unexported fields
}
OnePasswordCLIProvider implements the Provider interface using the 1Password CLI.
func NewOnePasswordCLIProvider ¶ added in v0.9.0
func NewOnePasswordCLIProvider(vault secretsConfigType.OnePasswordVault) *OnePasswordCLIProvider
NewOnePasswordCLIProvider creates a new OnePasswordCLIProvider instance.
func (*OnePasswordCLIProvider) LoadSecrets ¶ added in v0.9.0
func (s *OnePasswordCLIProvider) LoadSecrets() error
LoadSecrets marks the provider as unlocked.
func (*OnePasswordCLIProvider) Resolve ¶ added in v0.9.0
func (s *OnePasswordCLIProvider) Resolve(ref SecretRef) (string, bool, error)
Resolve fetches a secret from 1Password CLI. ref.Item is config-controlled and positional; it's placed after "--" (end-of-options) in the op argv so an item name beginning with "-" is parsed as the operand op expects, not as an op flag. Returns handled=true only if the vault ID matches.
type OnePasswordSDKProvider ¶ added in v0.9.0
type OnePasswordSDKProvider struct {
// contains filtered or unexported fields
}
OnePasswordSDKProvider implements the Provider interface using the 1Password SDK.
func NewOnePasswordSDKProvider ¶ added in v0.9.0
func NewOnePasswordSDKProvider(vault secretsConfigType.OnePasswordVault) *OnePasswordSDKProvider
NewOnePasswordSDKProvider creates a new OnePasswordSDKProvider instance.
func (*OnePasswordSDKProvider) LoadSecrets ¶ added in v0.9.0
func (s *OnePasswordSDKProvider) LoadSecrets() error
LoadSecrets marks the provider as unlocked.
type Provider ¶ added in v0.9.0
type Provider interface {
// LoadSecrets loads/unlocks the secret store.
LoadSecrets() error
// Resolve fetches a secret value by reference.
// Returns (value, handled, error). handled=false means this
// provider doesn't own the requested vault.
Resolve(ref SecretRef) (string, bool, error)
}
Provider is the minimal contract for secret backends.
type Resolver ¶ added in v0.9.0
type Resolver struct {
// contains filtered or unexported fields
}
Resolver dispatches secret references across configured providers and serves as the evaluator helper implementation.
func NewResolver ¶ added in v0.9.0
NewResolver creates a Resolver from the given providers and shell.
func (*Resolver) EvaluateHelper ¶ added in v0.9.0
EvaluateHelper is the expr helper callback for secret(vault, item, field). On first pass (deferred=false), returns DeferredError. On second pass (deferred=true), resolves the secret.
type SecretRef ¶ added in v0.9.0
type SecretRef struct {
Vault string // "sops" or a 1Password vault ID
Item string // item name or SOPS key path
Field string // field name (empty for SOPS)
}
SecretRef is the canonical internal representation of a secret reference. All notation formats normalize to this before resolution.
type Shims ¶
type Shims struct {
Stat func(string) (os.FileInfo, error)
YAMLUnmarshal func([]byte, any) error
DecryptFile func(string, string) ([]byte, error)
NewOnePasswordClient func(context.Context, ...onepassword.ClientOption) (*onepassword.Client, error)
ResolveSecret func(*onepassword.Client, context.Context, string) (string, error)
Command func(name string, arg ...string) *exec.Cmd
CmdOutput func(cmd *exec.Cmd) ([]byte, error)
}
Shims provides mockable wrappers around system and runtime functions
type SopsProvider ¶ added in v0.9.0
type SopsProvider struct {
// contains filtered or unexported fields
}
SopsProvider implements the Provider interface using SOPS for decryption.
func NewSopsProvider ¶ added in v0.9.0
func NewSopsProvider(configPath string) *SopsProvider
NewSopsProvider creates a new SopsProvider instance.
func (*SopsProvider) LoadSecrets ¶ added in v0.9.0
func (s *SopsProvider) LoadSecrets() error
LoadSecrets loads and decrypts secrets from all existing secrets files, including the conventionally-unencrypted secrets.yaml/secrets.yml names: content decides whether a file is SOPS-encrypted, not its name, since an operator's own SOPS file can be named either way. A secrets.yaml/secrets.yml that fails to decrypt is refused with a clear error naming the path rather than the raw sops failure, since the far more likely cause is a genuinely plaintext file that was never encrypted (and, without a matching .gitignore entry, at risk of being committed).
Source Files