Documentation
¶
Overview ¶
Package azure resolves secret.KindAzure refs by fetching from Azure Key Vault. Auth uses Entra ID client-credentials (or optional managed-identity IMDS) and only the Go standard library. Fetch-only: plaintext is held in memory, never written to Postgres.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
VaultURL string
TenantID string
ClientID string
ClientSecret string
UseManagedIdentity bool
HTTPClient *http.Client
// TokenEndpoint overrides the Entra token URL (tests).
TokenEndpoint string
// IMDSEndpoint overrides the managed-identity token URL (tests).
IMDSEndpoint string
Now func() time.Time
}
Config holds Key Vault and Entra settings. Secret fields must be supplied by the composition layer from env — never hard-coded.
func ConfigFromEnv ¶
ConfigFromEnv reads AZURE_KEYVAULT_URL and, unless AZURE_USE_MANAGED_IDENTITY=1, AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET.
Click to show internal directories.
Click to hide internal directories.