secrets

Documentation

Overview

Package secrets provides primitives for resolving secrets from external sources, such as Hashicorp Vault or Azure Key Vault, into Credential Sets and injecting them into bundle runtimes.

Index

• Constants
• type PluginAdapter
  • func NewPluginAdapter(plugin plugins.SecretsProtocol) PluginAdapter
  • func (a PluginAdapter) Close() error
  • func (a PluginAdapter) Create(ctx context.Context, keyName string, keyValue string, value string) error
  • func (a PluginAdapter) Resolve(ctx context.Context, keyName string, keyValue string) (string, error)
• type Set
  • func (s Set) IsValid(key string) bool
  • func (s Set) Merge(s2 Set) error
  • func (s Set) ToCNAB() valuesource.Set
• type Source
  • func (s Source) MarshalJSON() ([]byte, error)
  • func (s Source) MarshalRaw() interface{}
  • func (s Source) MarshalYAML() (interface{}, error)
  • func (s *Source) UnmarshalJSON(data []byte) error
  • func (s *Source) UnmarshalRaw(raw map[string]interface{}) error
  • func (s *Source) UnmarshalYAML(value *yaml.Node) error
• type Store
• type Strategy
• type TestSecretsProvider
  • func NewTestSecretsProvider() TestSecretsProvider
  • func (s TestSecretsProvider) Close() error

Constants

const SourceSecret = "secret"

Types

type PluginAdapter

type PluginAdapter struct {
	// contains filtered or unexported fields
}

PluginAdapter converts between the low-level plugins.SecretsProtocol and the secrets.Store interface.

func NewPluginAdapter

func NewPluginAdapter(plugin plugins.SecretsProtocol) PluginAdapter

NewPluginAdapter wraps the specified storage plugin.

func (PluginAdapter) Close

func (a PluginAdapter) Close() error

func (PluginAdapter) Create

func (a PluginAdapter) Create(ctx context.Context, keyName string, keyValue string, value string) error

func (PluginAdapter) Resolve

func (a PluginAdapter) Resolve(ctx context.Context, keyName string, keyValue string) (string, error)

type Set

type Set map[string]string

Set is an actual set of resolved values. This is the output of resolving a parameter or credential set file.

func (Set) IsValid

func (s Set) IsValid(key string) bool

IsValid determines if the provided key (designating a name of a parameter or credential) is included in the provided set

func (Set) Merge

func (s Set) Merge(s2 Set) error

Merge merges a second Set into the base.

Duplicate names are not allow and will result in an error, this is the case even if the values are identical.

func (Set) ToCNAB

func (s Set) ToCNAB() valuesource.Set

ToCNAB converts this to a type accepted by the cnab-go runtime.

type Source

type Source struct {
	Key   string
	Value string
}

Source represents a strategy for loading a value from local host.

func (Source) MarshalJSON

func (s Source) MarshalJSON() ([]byte, error)

func (Source) MarshalRaw

func (s Source) MarshalRaw() interface{}

func (Source) MarshalYAML

func (s Source) MarshalYAML() (interface{}, error)

func (*Source) UnmarshalJSON

func (s *Source) UnmarshalJSON(data []byte) error

func (*Source) UnmarshalRaw

func (s *Source) UnmarshalRaw(raw map[string]interface{}) error

func (*Source) UnmarshalYAML

func (s *Source) UnmarshalYAML(value *yaml.Node) error

type Store

type Store interface {
	Close() error

	// Resolve a credential's value from a secret store
	// - keyName is name of the key where the secret can be found.
	// - keyValue is the value of the key.
	// Examples:
	// - keyName=env, keyValue=CONN_STRING
	// - keyName=key, keyValue=conn-string
	// - keyName=path, keyValue=/tmp/connstring.txt
	Resolve(ctx context.Context, keyName string, keyValue string) (string, error)

	// Create stores a secret value in a secret store.
	// - keyName is name of the key where the secret can be found.
	// - keyValue is the value of the key.
	// Examples:
	// - keyName=env, keyValue=CONN_STRING, value=redis://foo
	// - keyName=key, keyValue=conn-string, value=redis://foo
	// - keyName=path, keyValue=/tmp/connstring.txt, value=redis://foo
	Create(ctx context.Context, keyName string, keyValue string, value string) error
}

Store is the interface that Porter uses to interact with secrets.

type Strategy

type Strategy struct {
	// Name is the name of the parameter or credential.
	Name string `json:"name" yaml:"name"`
	// Source is the location of the value.
	// During resolution, the source will be loaded, and the result temporarily placed
	// into Value.
	Source Source `json:"source,omitempty" yaml:"source,omitempty"`
	// Value holds the parameter or credential value.
	// When a parameter or credential is loaded, it is loaded into this field. In all
	// other cases, it is empty. This field is omitted during serialization.
	Value string `json:"-" yaml:"-"`
}

Strategy represents a strategy for determining the value of a parameter or credential

type TestSecretsProvider

type TestSecretsProvider struct {
	PluginAdapter
	// contains filtered or unexported fields
}

func NewTestSecretsProvider

func NewTestSecretsProvider() TestSecretsProvider

func (TestSecretsProvider) Close

func (s TestSecretsProvider) Close() error