vault

Documentation

Index

• func GetKubeSecretDetailsFromVaultPath(credentialsPath string) (string, string, error)
• func PathForReadingKubeSecret(secretNamespace, secretName string) string
• type Connection
  • func NewConnection(addr, token string) (*Connection, error)
  • func (c *Connection) AddSecret(path string, credentials map[string]interface{}) error
  • func (c *Connection) AddSecretFromStruct(path string, creds interface{}) error
  • func (c *Connection) DeletePolicy(policyName string) error
  • func (c *Connection) DeleteSecret(vaultPath string) error
  • func (c *Connection) GetSecret(vaultPath string) (string, error)
  • func (c *Connection) LinkPolicyToIdentity(identity, policyName, boundedNamespace, serviceAccount, auth, ttl string) error
  • func (c *Connection) Mount(path string) error
  • func (c *Connection) RemovePolicyFromIdentity(identity, policyName, auth string) error
  • func (c *Connection) WritePolicy(policyName, policy string) error
• type Dummy
  • func NewDummyConnection() *Dummy
  • func (c *Dummy) AddSecret(path string, credentials map[string]interface{}) error
  • func (c *Dummy) AddSecretFromStruct(path string, creds interface{}) error
  • func (c *Dummy) DeletePolicy(policyName string) error
  • func (c *Dummy) DeleteSecret(vaultPath string) error
  • func (c *Dummy) GetSecret(vaultPath string) (string, error)
  • func (c *Dummy) LinkPolicyToIdentity(identity, policyName, boundedNamespace, serviceAccount, auth, ttl string) error
  • func (c *Dummy) Mount(path string) error
  • func (c *Dummy) RemovePolicyFromIdentity(identity, policyName, auth string) error
  • func (c *Dummy) WritePolicy(policyName, policy string) error
• type Interface
  • func InitConnection(addr, token string) (Interface, error)

Functions

func GetKubeSecretDetailsFromVaultPath

func GetKubeSecretDetailsFromVaultPath(credentialsPath string) (string, string, error)

Given a path to Vault secret that holds dataset credentials return the name of the secret and its namespace for example, for vault secret path: "/v1/kubernetes-secrets/my-secret?namespace=default" the returned values will be my-secret and default

func PathForReadingKubeSecret

func PathForReadingKubeSecret(secretNamespace, secretName string) string

PathForReadingKubeSecret returns the path to Vault secret that holds dataset credentials stored in kubernetes secret. Vault plugin vault-plugin-secrets-kubernetes-reader is used for reading kubernetes secret (https://github.com/fybrik/vault-plugin-secrets-kubernetes-reader) The path contains the following parts: - pluginPath is the Vault path where vault-plugin-secrets-kubernetes-reader plugin is enabled. - secret name - secret namespace for example, for secret name my-secret and namespace default it will be of the form: "/v1/kubernetes-secrets/my-secret?namespace=default"

Types

type Connection

type Connection struct {
	Client  *api.Client
	Address string
	Token   string
}

Connection contains required information for connecting to vault

func NewConnection

func NewConnection(addr, token string) (*Connection, error)

NewConnection returns a new Connection object

func (*Connection) AddSecret

func (c *Connection) AddSecret(path string, credentials map[string]interface{}) error

AddSecret adds a secret to vault

func (*Connection) AddSecretFromStruct

func (c *Connection) AddSecretFromStruct(path string, creds interface{}) error

AddSecretFromStruct constructs a vault secret from the given structure

func (*Connection) DeletePolicy

func (c *Connection) DeletePolicy(policyName string) error

DeletePolicy removes the policy with the given name from vault

func (*Connection) DeleteSecret

func (c *Connection) DeleteSecret(vaultPath string) error

DeleteSecret deletes a secret

func (*Connection) GetSecret

func (c *Connection) GetSecret(vaultPath string) (string, error)

GetSecret returns the stored secret as json

func (*Connection) LinkPolicyToIdentity

func (c *Connection) LinkPolicyToIdentity(identity, policyName, boundedNamespace, serviceAccount, auth, ttl string) error

LinkPolicyToIdentity registers a policy for a given identity or role, meaning that when a person or service of that identity logs into vault and tries to read or write a secret the provided policy will determine whether that is allowed or not.

func (*Connection) Mount

func (c *Connection) Mount(path string) error

Mount mounts a key-value secret provider (kv version 1) to manage the storage of the secrets

func (*Connection) RemovePolicyFromIdentity

func (c *Connection) RemovePolicyFromIdentity(identity, policyName, auth string) error

RemovePolicyFromIdentity removes the policy from the authentication identity with which it is associated, meaning this policy will no longer be invoked when a person or service authenticates with this identity.

func (*Connection) WritePolicy

func (c *Connection) WritePolicy(policyName, policy string) error

WritePolicy stores in vault the policy indicated. This can be associated with a vault token or an authentication identity to ensure proper use of secrets. Example policy: "path \"identities/test-identity\" {\n capabilities = [\"read\"]\n }"

NOTE the line returns and the tab.  Without them it fails!

type Dummy

type Dummy struct {
	// contains filtered or unexported fields
}

Dummy implementation for testing

func NewDummyConnection

func NewDummyConnection() *Dummy

NewDummyConnection returns a new Dummy object

func (*Dummy) AddSecret

func (c *Dummy) AddSecret(path string, credentials map[string]interface{}) error

func (*Dummy) AddSecretFromStruct

func (c *Dummy) AddSecretFromStruct(path string, creds interface{}) error

func (*Dummy) DeletePolicy

func (c *Dummy) DeletePolicy(policyName string) error

func (*Dummy) DeleteSecret

func (c *Dummy) DeleteSecret(vaultPath string) error

func (*Dummy) GetSecret

func (c *Dummy) GetSecret(vaultPath string) (string, error)

func (*Dummy) LinkPolicyToIdentity

func (c *Dummy) LinkPolicyToIdentity(identity, policyName, boundedNamespace, serviceAccount, auth, ttl string) error

func (*Dummy) Mount

func (c *Dummy) Mount(path string) error

func (*Dummy) RemovePolicyFromIdentity

func (c *Dummy) RemovePolicyFromIdentity(identity, policyName, auth string) error

func (*Dummy) WritePolicy

func (c *Dummy) WritePolicy(policyName, policy string) error

type Interface

type Interface interface {
	LinkPolicyToIdentity(identity string, policyName string, boundedNamespace string, serviceAccount string, auth string, ttl string) error
	RemovePolicyFromIdentity(identity string, policyName string, auth string) error
	WritePolicy(policyName string, policy string) error
	DeletePolicy(policyName string) error
	Mount(path string) error
	DeleteSecret(vaultPath string) error
	GetSecret(vaultPath string) (string, error)
	AddSecret(path string, credentials map[string]interface{}) error
	AddSecretFromStruct(path string, creds interface{}) error
}

Interface provides vault functionality

func InitConnection

func InitConnection(addr, token string) (Interface, error)

InitConnection creates a new connection to vault. Note that it assumes that the home path has been mounted during the vault setup.