azure

package
v0.4.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 28, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

Package azure resolves secret.KindAzure refs by fetching from Azure Key Vault. Auth uses Entra ID client-credentials (or optional managed-identity IMDS) and only the Go standard library. Fetch-only: plaintext is held in memory, never written to Postgres.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Config

type Config struct {
	VaultURL           string
	TenantID           string
	ClientID           string
	ClientSecret       string
	UseManagedIdentity bool
	HTTPClient         *http.Client
	// TokenEndpoint overrides the Entra token URL (tests).
	TokenEndpoint string
	// IMDSEndpoint overrides the managed-identity token URL (tests).
	IMDSEndpoint string
	Now          func() time.Time
}

Config holds Key Vault and Entra settings. Secret fields must be supplied by the composition layer from env — never hard-coded.

func ConfigFromEnv

func ConfigFromEnv() (Config, error)

ConfigFromEnv reads AZURE_KEYVAULT_URL and, unless AZURE_USE_MANAGED_IDENTITY=1, AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET.

type Resolver

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver fetches secrets from Azure Key Vault (KindAzure only).

func New

func New(cfg Config) *Resolver

New returns a Resolver for secret.KindAzure refs.

func (*Resolver) Resolve

func (r *Resolver) Resolve(ctx context.Context, ref secret.Ref) ([]byte, error)

Resolve returns the secret value for ref.Path = "<secretName>[/<version>]". The vault URL comes from Config.VaultURL.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL