secrets

Documentation

Overview

Package secrets provides primitives for resolving secrets from external sources, such as Hashicorp Vault or Azure Key Vault, into Credential Sets and injecting them into bundle runtimes.

Index

• Constants
• type PluginAdapter
  • func NewPluginAdapter(plugin plugins.SecretsProtocol) PluginAdapter
  • func (a PluginAdapter) Close() error
  • func (a PluginAdapter) Create(ctx context.Context, keyName string, keyValue string, value string) error
  • func (a PluginAdapter) Resolve(ctx context.Context, keyName string, keyValue string) (string, error)
• type Set
  • func (s Set) IsValid(key string) bool
  • func (s Set) Merge(s2 Set) error
  • func (s Set) ToCNAB() valuesource.Set
• type Source
  • func (s Source) MarshalJSON() ([]byte, error)
  • func (s Source) MarshalRaw() interface{}
  • func (s Source) MarshalYAML() (interface{}, error)
  • func (s *Source) UnmarshalJSON(data []byte) error
  • func (s *Source) UnmarshalRaw(raw map[string]interface{}) error
  • func (s *Source) UnmarshalYAML(value *yaml.Node) error
• type SourceMap
• type Store
• type StrategyList
  • func (l StrategyList) Len() int
  • func (l StrategyList) Less(i, j int) bool
  • func (l StrategyList) Swap(i, j int)
• type TestSecretsProvider
  • func NewTestSecretsProvider() TestSecretsProvider
  • func (s TestSecretsProvider) Close() error

Constants

const SourceSecret = "secret"

Types

type PluginAdapter

type PluginAdapter struct {
	// contains filtered or unexported fields
}

PluginAdapter converts between the low-level plugins.SecretsProtocol and the secrets.Store interface.

func NewPluginAdapter

func NewPluginAdapter(plugin plugins.SecretsProtocol) PluginAdapter

NewPluginAdapter wraps the specified storage plugin.

func (PluginAdapter) Close

func (a PluginAdapter) Close() error

func (PluginAdapter) Create

func (a PluginAdapter) Create(ctx context.Context, keyName string, keyValue string, value string) error

func (PluginAdapter) Resolve

func (a PluginAdapter) Resolve(ctx context.Context, keyName string, keyValue string) (string, error)

type Set

type Set map[string]string

Set is an actual set of resolved values. This is the output of resolving a parameter or credential set file.

func (Set) IsValid

func (s Set) IsValid(key string) bool

IsValid determines if the provided key (designating a name of a parameter or credential) is included in the provided set

func (Set) Merge

func (s Set) Merge(s2 Set) error

Merge merges a second Set into the base.

Duplicate names are not allow and will result in an error, this is the case even if the values are identical.

func (Set) ToCNAB

func (s Set) ToCNAB() valuesource.Set

ToCNAB converts this to a type accepted by the cnab-go runtime.

type Source

type Source struct {
	// Strategy to resolve the source value, e.g. "secret" or "env".
	Strategy string

	// Hint to the strategy handler on how to resolve the value.
	// For example the name of the secret in a secret store or name of an environment variable.
	Hint string
}

Source specifies how to resolve a parameter or credential from an external source.

func (Source) MarshalJSON

func (s Source) MarshalJSON() ([]byte, error)

func (Source) MarshalRaw

func (s Source) MarshalRaw() interface{}

func (Source) MarshalYAML

func (s Source) MarshalYAML() (interface{}, error)

func (*Source) UnmarshalJSON

func (s *Source) UnmarshalJSON(data []byte) error

func (*Source) UnmarshalRaw

func (s *Source) UnmarshalRaw(raw map[string]interface{}) error

func (*Source) UnmarshalYAML

func (s *Source) UnmarshalYAML(value *yaml.Node) error

type SourceMap

type SourceMap struct {
	// Name is the name of the parameter or credential.
	Name string `json:"name" yaml:"name"`

	// Source defines a strategy for resolving a value from the specified source.
	Source Source `json:"source,omitempty" yaml:"source,omitempty"`

	// ResolvedValue holds the resolved parameter or credential value.
	// When a parameter or credential is resolved, it is loaded into this field. In all
	// other cases, it is empty. This field is omitted during serialization.
	ResolvedValue string `json:"-" yaml:"-"`
}

SourceMap maps from a parameter or credential name to a source strategy for resolving its value.

type Store

type Store interface {
	Close() error

	// Resolve a credential's value from a secret store
	// - keyName is name of the key where the secret can be found.
	// - keyValue is the value of the key.
	// Examples:
	// - keyName=env, keyValue=CONN_STRING
	// - keyName=key, keyValue=conn-string
	// - keyName=path, keyValue=/tmp/connstring.txt
	Resolve(ctx context.Context, keyName string, keyValue string) (string, error)

	// Create stores a secret value in a secret store.
	// - keyName is name of the key where the secret can be found.
	// - keyValue is the value of the key.
	// Examples:
	// - keyName=env, keyValue=CONN_STRING, value=redis://foo
	// - keyName=key, keyValue=conn-string, value=redis://foo
	// - keyName=path, keyValue=/tmp/connstring.txt, value=redis://foo
	Create(ctx context.Context, keyName string, keyValue string, value string) error
}

Store is the interface that Porter uses to interact with secrets.

type StrategyList

type StrategyList []SourceMap

func (StrategyList) Len

func (l StrategyList) Len() int

func (StrategyList) Less

func (l StrategyList) Less(i, j int) bool

func (StrategyList) Swap

func (l StrategyList) Swap(i, j int)

type TestSecretsProvider

type TestSecretsProvider struct {
	PluginAdapter
	// contains filtered or unexported fields
}

func NewTestSecretsProvider

func NewTestSecretsProvider() TestSecretsProvider

func (TestSecretsProvider) Close

func (s TestSecretsProvider) Close() error