Documentation
¶
Overview ¶
Package confy provides confy ConfigSource and SecretProvider adapters backed by vault's config and secret stores. This allows forge applications to use vault-managed configuration and secrets via the confy config system.
Index ¶
- type SecretReader
- type SecretService
- type VaultConfigSource
- func (s *VaultConfigSource) GetName() string
- func (s *VaultConfigSource) GetSecret(ctx context.Context, key string) (string, error)
- func (s *VaultConfigSource) GetType() string
- func (s *VaultConfigSource) IsAvailable(ctx context.Context) bool
- func (s *VaultConfigSource) IsWatchable() bool
- func (s *VaultConfigSource) Load(ctx context.Context) (map[string]any, error)
- func (s *VaultConfigSource) Name() string
- func (s *VaultConfigSource) Priority() int
- func (s *VaultConfigSource) Reload(ctx context.Context) error
- func (s *VaultConfigSource) StopWatch() error
- func (s *VaultConfigSource) SupportsSecrets() bool
- func (s *VaultConfigSource) Watch(ctx context.Context, callback func(map[string]any)) error
- type VaultSecretProvider
- func (p *VaultSecretProvider) Close(_ context.Context) error
- func (p *VaultSecretProvider) DeleteSecret(ctx context.Context, key string) error
- func (p *VaultSecretProvider) GetSecret(ctx context.Context, key string) (string, error)
- func (p *VaultSecretProvider) HealthCheck(ctx context.Context) error
- func (p *VaultSecretProvider) Initialize(_ context.Context, _ map[string]any) error
- func (p *VaultSecretProvider) ListSecrets(ctx context.Context) ([]string, error)
- func (p *VaultSecretProvider) Name() string
- func (p *VaultSecretProvider) SetSecret(ctx context.Context, key, value string) error
- func (p *VaultSecretProvider) SupportsCaching() bool
- func (p *VaultSecretProvider) SupportsRotation() bool
- type VaultSourceOption
- func WithKeyPatterns(patterns ...string) VaultSourceOption
- func WithKeyPrefix(prefix string) VaultSourceOption
- func WithKeys(keys ...string) VaultSourceOption
- func WithSourceMetrics(m gometrics.Metrics) VaultSourceOption
- func WithSourceName(name string) VaultSourceOption
- func WithSourcePollInterval(d time.Duration) VaultSourceOption
- func WithSourcePriority(p int) VaultSourceOption
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type SecretReader ¶
SecretReader reads and decrypts a secret. *secret.Service satisfies it. confy reads through the service rather than the store because no store backend keeps a decrypted value: only the service can produce one.
type SecretService ¶
type SecretService interface {
SecretReader
Set(ctx context.Context, key string, value []byte, appID string, opts ...secret.SetOption) (*secret.Meta, error)
Delete(ctx context.Context, key, appID string) error
List(ctx context.Context, appID string, opts secret.ListOpts) ([]*secret.Meta, error)
}
SecretService is what VaultSecretProvider needs: read, write, delete and list. *secret.Service satisfies it. Taking the full surface at the constructor means a value that cannot write is a compile error rather than a provider that reports itself unhealthy at runtime.
type VaultConfigSource ¶
type VaultConfigSource struct {
// contains filtered or unexported fields
}
VaultConfigSource is a confy ConfigSource backed by vault's config and secret stores.
func NewVaultConfigSource ¶
func NewVaultConfigSource(configStore config.Store, secrets SecretReader, appID string, opts ...VaultSourceOption) *VaultConfigSource
NewVaultConfigSource creates a new VaultConfigSource. secrets reads through vault's secret service rather than a raw secret.Store, because no store backend keeps a decrypted value.
func (*VaultConfigSource) GetName ¶
func (s *VaultConfigSource) GetName() string
GetName returns the source name (alias for Name).
func (*VaultConfigSource) GetSecret ¶
GetSecret retrieves and decrypts a secret through the vault secret service.
func (*VaultConfigSource) GetType ¶
func (s *VaultConfigSource) GetType() string
GetType returns the source type.
func (*VaultConfigSource) IsAvailable ¶
func (s *VaultConfigSource) IsAvailable(ctx context.Context) bool
IsAvailable checks if the vault config store is reachable.
func (*VaultConfigSource) IsWatchable ¶
func (s *VaultConfigSource) IsWatchable() bool
IsWatchable returns true — vault config source supports polling-based watch.
func (*VaultConfigSource) Load ¶
Load returns config entries for the app as a flat map, filtered and prefixed according to the configured mount options.
func (*VaultConfigSource) Name ¶
func (s *VaultConfigSource) Name() string
Name returns the source name.
func (*VaultConfigSource) Priority ¶
func (s *VaultConfigSource) Priority() int
Priority returns the source priority.
func (*VaultConfigSource) Reload ¶
func (s *VaultConfigSource) Reload(ctx context.Context) error
Reload re-fetches all config from the store.
func (*VaultConfigSource) StopWatch ¶
func (s *VaultConfigSource) StopWatch() error
StopWatch stops the watch goroutine.
func (*VaultConfigSource) SupportsSecrets ¶
func (s *VaultConfigSource) SupportsSecrets() bool
SupportsSecrets returns true if a secret reader is configured.
type VaultSecretProvider ¶
type VaultSecretProvider struct {
// contains filtered or unexported fields
}
VaultSecretProvider is a confy SecretProvider backed by vault's secret service.
func NewVaultSecretProvider ¶
func NewVaultSecretProvider(secrets SecretService, appID string) *VaultSecretProvider
NewVaultSecretProvider creates a new VaultSecretProvider. secrets is vault's secret service rather than a raw secret.Store, because no store backend keeps a decrypted value.
func (*VaultSecretProvider) Close ¶
func (p *VaultSecretProvider) Close(_ context.Context) error
Close is a no-op — the store lifecycle is managed by the extension.
func (*VaultSecretProvider) DeleteSecret ¶
func (p *VaultSecretProvider) DeleteSecret(ctx context.Context, key string) error
DeleteSecret removes a secret.
func (*VaultSecretProvider) GetSecret ¶
GetSecret retrieves and decrypts a secret value as a string.
func (*VaultSecretProvider) HealthCheck ¶
func (p *VaultSecretProvider) HealthCheck(ctx context.Context) error
HealthCheck verifies the secret service is accessible.
func (*VaultSecretProvider) Initialize ¶
Initialize is a no-op — the provider is fully configured via constructor.
func (*VaultSecretProvider) ListSecrets ¶
func (p *VaultSecretProvider) ListSecrets(ctx context.Context) ([]string, error)
ListSecrets returns all secret keys for the app.
func (*VaultSecretProvider) Name ¶
func (p *VaultSecretProvider) Name() string
Name returns the provider name.
func (*VaultSecretProvider) SetSecret ¶
func (p *VaultSecretProvider) SetSecret(ctx context.Context, key, value string) error
SetSecret creates or updates a secret.
func (*VaultSecretProvider) SupportsCaching ¶
func (p *VaultSecretProvider) SupportsCaching() bool
SupportsCaching returns false — the vault store handles its own caching.
func (*VaultSecretProvider) SupportsRotation ¶
func (p *VaultSecretProvider) SupportsRotation() bool
SupportsRotation returns false — rotation is managed by vault's rotation service.
type VaultSourceOption ¶
type VaultSourceOption func(*VaultConfigSource)
VaultSourceOption configures a VaultConfigSource.
func WithKeyPatterns ¶
func WithKeyPatterns(patterns ...string) VaultSourceOption
WithKeyPatterns restricts which vault keys are mounted into confy using glob patterns (e.g. "db.*", "auth.**", "feature.flags.*"). Uses filepath.Match semantics. Multiple patterns are OR-ed together. When empty (the default), all keys are included.
func WithKeyPrefix ¶
func WithKeyPrefix(prefix string) VaultSourceOption
WithKeyPrefix sets a prefix that is prepended to all vault keys when exposed through confy. For example, WithKeyPrefix("vault.") causes a vault key "db.host" to appear as "vault.db.host" in confy.
func WithKeys ¶
func WithKeys(keys ...string) VaultSourceOption
WithKeys restricts which vault keys are mounted into confy. Only the listed keys will be included; all others are filtered out. When empty (the default), all keys are included.
func WithSourceMetrics ¶
func WithSourceMetrics(m gometrics.Metrics) VaultSourceOption
WithSourceMetrics counts the source's watch polls on m by result: changed, unchanged or error. A poll that fails is otherwise silent, since confy's callback only hears about changes. In a Forge app pass app.Metrics(); vault's Forge extension does this for you. A nil m records nothing.
func WithSourceName ¶
func WithSourceName(name string) VaultSourceOption
WithSourceName sets the source name. Default is "vault".
func WithSourcePollInterval ¶
func WithSourcePollInterval(d time.Duration) VaultSourceOption
WithSourcePollInterval sets the watch poll interval. Default is 30s.
func WithSourcePriority ¶
func WithSourcePriority(p int) VaultSourceOption
WithSourcePriority sets the source priority. Default is 100.
Source Files