Documentation ¶
Index ¶
- Constants
- Variables
- type AdvertiseDetect
- type AzureBackend
- type Backend
- type Cache
- type ConsulBackend
- func (c *ConsulBackend) Delete(key string) error
- func (c *ConsulBackend) DetectHostAddr() (string, error)
- func (c *ConsulBackend) Get(key string) (*Entry, error)
- func (c *ConsulBackend) List(prefix string) ([]string, error)
- func (c *ConsulBackend) LockWith(key, value string) (Lock, error)
- func (c *ConsulBackend) NotifyActiveStateChange() error
- func (c *ConsulBackend) NotifySealedStateChange() error
- func (c *ConsulBackend) Put(entry *Entry) error
- func (c *ConsulBackend) RunServiceDiscovery(shutdownCh ShutdownChannel, advertiseAddr string, activeFunc activeFunction, ...) (err error)
- type ConsulLock
- type DynamoDBBackend
- type DynamoDBLock
- type DynamoDBRecord
- type Entry
- type EtcdBackend
- type EtcdLock
- type Factory
- type FileBackend
- type HABackend
- type InmemBackend
- type InmemHABackend
- type InmemLock
- type Lock
- type MySQLBackend
- type PermitPool
- type PostgreSQLBackend
- type S3Backend
- type ServiceDiscovery
- type ShutdownChannel
- type ZookeeperBackend
- type ZookeeperHALock
Constants ¶
const ( // DefaultDynamoDBRegion is used when no region is configured // explicitly. DefaultDynamoDBRegion = "us-east-1" // DefaultDynamoDBTableName is used when no table name // is configured explicitly. DefaultDynamoDBTableName = "vault-dynamodb-backend" // DefaultDynamoDBReadCapacity is the default read capacity // that is used when none is configured explicitly. DefaultDynamoDBReadCapacity = 5 // DefaultDynamoDBWriteCapacity is the default write capacity // that is used when none is configured explicitly. DefaultDynamoDBWriteCapacity = 5 // DynamoDBEmptyPath is the string that is used instead of // empty strings when stored in DynamoDB. DynamoDBEmptyPath = " " // DynamoDBLockPrefix is the prefix used to mark DynamoDB records // as locks. This prefix causes them not to be returned by // List operations. DynamoDBLockPrefix = "_" // DynamoDBLockRetryInterval is the amount of time to wait // if a lock fails before trying again. DynamoDBLockRetryInterval = time.Second // DynamoDBWatchRetryMax is the number of times to re-try a // failed watch before signaling that leadership is lost. DynamoDBWatchRetryMax = 5 // DynamoDBWatchRetryInterval is the amount of time to wait // if a watch fails before trying again. DynamoDBWatchRetryInterval = 5 * time.Second )
const ( // Ideally, this prefix would match the "_" used in the file backend, but // that prefix has special meaining in etcd. Specifically, it excludes those // entries from directory listings. EtcdNodeFilePrefix = "." // The lock prefix can (and probably should) cause an entry to be excluded // from diretory listings, so "_" works here. EtcdNodeLockPrefix = "_" // The delimiter is the same as the `-C` flag of etcdctl. EtcdMachineDelimiter = "," // The lock TTL matches the default that Consul API uses, 15 seconds. EtcdLockTTL = 15 * time.Second // The amount of time to wait between the semaphore key renewals EtcdLockRenewInterval = 5 * time.Second // The amount of time to wait if a watch fails before trying again. EtcdWatchRetryInterval = time.Second // The number of times to re-try a failed watch before signaling that leadership is lost. EtcdWatchRetryMax = 5 )
const (
// DefaultCacheSize is used if no cache size is specified for NewCache
DefaultCacheSize = 32 * 1024
)
const DefaultParallelOperations = 128
const ( // ZKNodeFilePrefix is prefixed to any "files" in ZooKeeper, // so that they do not collide with directory entries. Otherwise, // we cannot delete a file if the path is a full-prefix of another // key. ZKNodeFilePrefix = "_" )
Variables ¶
var ( EtcdSyncConfigError = errors.New("client setup failed: unable to parse etcd sync field in config") EtcdSyncClusterError = errors.New("client setup failed: unable to sync etcd cluster") EtcdAddressError = errors.New("client setup failed: address must be valid URL (ex. 'scheme://host:port')") EtcdSemaphoreKeysEmptyError = errors.New("lock queue is empty") EtcdLockHeldError = errors.New("lock already held") EtcdLockNotHeldError = errors.New("lock not held") EtcdSemaphoreKeyRemovedError = errors.New("semaphore key removed before lock aquisition") )
var MaxBlobSize = 1024 * 1024 * 4
MaxBlobSize at this time
Functions ¶
This section is empty.
Types ¶
type AdvertiseDetect ¶ added in v0.1.2
type AdvertiseDetect interface { // DetectHostAddr is used to detect the host address DetectHostAddr() (string, error) }
AdvertiseDetect is an optional interface that an HABackend can implement. If they do, an advertise address can be automatically detected.
type AzureBackend ¶ added in v0.6.0
type AzureBackend struct {
// contains filtered or unexported fields
}
AzureBackend is a physical backend that stores data within an Azure blob container.
func (*AzureBackend) Delete ¶ added in v0.6.0
func (a *AzureBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*AzureBackend) Get ¶ added in v0.6.0
func (a *AzureBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*AzureBackend) List ¶ added in v0.6.0
func (a *AzureBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*AzureBackend) Put ¶ added in v0.6.0
func (a *AzureBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type Backend ¶
type Backend interface { // Put is used to insert or update an entry Put(entry *Entry) error // Get is used to fetch an entry Get(key string) (*Entry, error) // Delete is used to permanently delete an entry Delete(key string) error // List is used ot list all the keys under a given // prefix, up to the next prefix. List(prefix string) ([]string, error) }
Backend is the interface required for a physical backend. A physical backend is used to durably store data outside of Vault. As such, it is completely untrusted, and is only accessed via a security barrier. The backends must represent keys in a hierarchical manner. All methods are expected to be thread safe.
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
Cache is used to wrap an underlying physical backend and provide an LRU cache layer on top. Most of the reads done by Vault are for policy objects so there is a large read reduction by using a simple write-through cache.
type ConsulBackend ¶
type ConsulBackend struct {
// contains filtered or unexported fields
}
ConsulBackend is a physical backend that stores data at specific prefix within Consul. It is used for most production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*ConsulBackend) Delete ¶
func (c *ConsulBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*ConsulBackend) DetectHostAddr ¶ added in v0.1.2
func (c *ConsulBackend) DetectHostAddr() (string, error)
DetectHostAddr is used to detect the host address by asking the Consul agent
func (*ConsulBackend) Get ¶
func (c *ConsulBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*ConsulBackend) List ¶
func (c *ConsulBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*ConsulBackend) LockWith ¶
func (c *ConsulBackend) LockWith(key, value string) (Lock, error)
Lock is used for mutual exclusion based on the given key.
func (*ConsulBackend) NotifyActiveStateChange ¶ added in v0.6.0
func (c *ConsulBackend) NotifyActiveStateChange() error
func (*ConsulBackend) NotifySealedStateChange ¶ added in v0.6.0
func (c *ConsulBackend) NotifySealedStateChange() error
func (*ConsulBackend) Put ¶
func (c *ConsulBackend) Put(entry *Entry) error
Put is used to insert or update an entry
func (*ConsulBackend) RunServiceDiscovery ¶ added in v0.6.0
func (c *ConsulBackend) RunServiceDiscovery(shutdownCh ShutdownChannel, advertiseAddr string, activeFunc activeFunction, sealedFunc sealedFunction) (err error)
type ConsulLock ¶
type ConsulLock struct {
// contains filtered or unexported fields
}
ConsulLock is used to provide the Lock interface backed by Consul
func (*ConsulLock) Lock ¶
func (c *ConsulLock) Lock(stopCh <-chan struct{}) (<-chan struct{}, error)
func (*ConsulLock) Unlock ¶
func (c *ConsulLock) Unlock() error
type DynamoDBBackend ¶ added in v0.5.0
type DynamoDBBackend struct {
// contains filtered or unexported fields
}
DynamoDBBackend is a physical backend that stores data in a DynamoDB table. It can be run in high-availability mode as DynamoDB has locking capabilities.
func (*DynamoDBBackend) Delete ¶ added in v0.5.0
func (d *DynamoDBBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*DynamoDBBackend) Get ¶ added in v0.5.0
func (d *DynamoDBBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*DynamoDBBackend) List ¶ added in v0.5.0
func (d *DynamoDBBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*DynamoDBBackend) LockWith ¶ added in v0.5.0
func (d *DynamoDBBackend) LockWith(key, value string) (Lock, error)
LockWith is used for mutual exclusion based on the given key.
func (*DynamoDBBackend) Put ¶ added in v0.5.0
func (d *DynamoDBBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type DynamoDBLock ¶ added in v0.5.0
type DynamoDBLock struct {
// contains filtered or unexported fields
}
DynamoDBLock implements a lock using an DynamoDB client.
func (*DynamoDBLock) Lock ¶ added in v0.5.0
func (l *DynamoDBLock) Lock(stopCh <-chan struct{}) (doneCh <-chan struct{}, retErr error)
Lock tries to acquire the lock by repeatedly trying to create a record in the DynamoDB table. It will block until either the stop channel is closed or the lock could be acquired successfully. The returned channel will be closed once the lock is deleted or changed in the DynamoDB table.
func (*DynamoDBLock) Unlock ¶ added in v0.5.0
func (l *DynamoDBLock) Unlock() error
Unlock releases the lock by deleting the lock record from the DynamoDB table.
type DynamoDBRecord ¶ added in v0.5.0
DynamoDBRecord is the representation of a vault entry in DynamoDB. The vault key is split up into two components (Path and Key) in order to allow more efficient listings.
type EtcdBackend ¶ added in v0.2.0
type EtcdBackend struct {
// contains filtered or unexported fields
}
EtcdBackend is a physical backend that stores data at specific prefix within Etcd. It is used for most production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*EtcdBackend) Delete ¶ added in v0.2.0
func (c *EtcdBackend) Delete(key string) error
Delete is used to permanently delete an entry.
func (*EtcdBackend) Get ¶ added in v0.2.0
func (c *EtcdBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry.
func (*EtcdBackend) List ¶ added in v0.2.0
func (c *EtcdBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*EtcdBackend) LockWith ¶ added in v0.2.0
func (c *EtcdBackend) LockWith(key, value string) (Lock, error)
Lock is used for mutual exclusion based on the given key.
func (*EtcdBackend) Put ¶ added in v0.2.0
func (c *EtcdBackend) Put(entry *Entry) error
Put is used to insert or update an entry.
type EtcdLock ¶ added in v0.2.0
type EtcdLock struct {
// contains filtered or unexported fields
}
EtcdLock emplements a lock using and etcd backend.
func (*EtcdLock) Lock ¶ added in v0.2.0
Lock attempts to acquire the lock by waiting for a new semaphore key in etcd to become the first in the queue and will block until it is successful or it receives a signal on the provided channel. The returned channel will be closed when the lock is lost, either by an explicit call to Unlock or by the associated semaphore key in etcd otherwise being deleted or expiring.
If the lock is currently held by this instance of EtcdLock, Lock will return an EtcdLockHeldError error.
type FileBackend ¶
type FileBackend struct { Path string // contains filtered or unexported fields }
FileBackend is a physical backend that stores data on disk at a given file path. It can be used for durable single server situations, or to develop locally where durability is not critical.
WARNING: the file backend implementation is currently extremely unsafe and non-performant. It is meant mostly for local testing and development. It can be improved in the future.
func (*FileBackend) Delete ¶
func (b *FileBackend) Delete(k string) error
func (*FileBackend) Put ¶
func (b *FileBackend) Put(entry *Entry) error
type HABackend ¶
type HABackend interface { // LockWith is used for mutual exclusion based on the given key. LockWith(key, value string) (Lock, error) }
HABackend is an extensions to the standard physical backend to support high-availability. Vault only expects to use mutual exclusion to allow multiple instances to act as a hot standby for a leader that services all requests.
type InmemBackend ¶
type InmemBackend struct {
// contains filtered or unexported fields
}
InmemBackend is an in-memory only physical backend. It is useful for testing and development situations where the data is not expected to be durable.
func NewInmem ¶
func NewInmem(logger *log.Logger) *InmemBackend
NewInmem constructs a new in-memory backend
func (*InmemBackend) Delete ¶
func (i *InmemBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*InmemBackend) Get ¶
func (i *InmemBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*InmemBackend) List ¶
func (i *InmemBackend) List(prefix string) ([]string, error)
List is used ot list all the keys under a given prefix, up to the next prefix.
func (*InmemBackend) Put ¶
func (i *InmemBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type InmemHABackend ¶
type InmemHABackend struct { InmemBackend // contains filtered or unexported fields }
func NewInmemHA ¶
func NewInmemHA(logger *log.Logger) *InmemHABackend
NewInmemHA constructs a new in-memory HA backend. This is only for testing.
func (*InmemHABackend) LockMapSize ¶ added in v0.5.0
func (i *InmemHABackend) LockMapSize() int
LockMapSize is used in some tests to determine whether this backend has ever been used for HA purposes rather than simply for storage
type InmemLock ¶
type InmemLock struct {
// contains filtered or unexported fields
}
InmemLock is an in-memory Lock implementation for the HABackend
type Lock ¶
type Lock interface { // Lock is used to acquire the given lock // The stopCh is optional and if closed should interrupt the lock // acquisition attempt. The return struct should be closed when // leadership is lost. Lock(stopCh <-chan struct{}) (<-chan struct{}, error) // Unlock is used to release the lock Unlock() error // Returns the value of the lock and if it is held Value() (bool, string, error) }
type MySQLBackend ¶ added in v0.2.0
type MySQLBackend struct {
// contains filtered or unexported fields
}
MySQLBackend is a physical backend that stores data within MySQL database.
func (*MySQLBackend) Delete ¶ added in v0.2.0
func (m *MySQLBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*MySQLBackend) Get ¶ added in v0.2.0
func (m *MySQLBackend) Get(key string) (*Entry, error)
Get is used to fetch and entry.
func (*MySQLBackend) List ¶ added in v0.2.0
func (m *MySQLBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*MySQLBackend) Put ¶ added in v0.2.0
func (m *MySQLBackend) Put(entry *Entry) error
Put is used to insert or update an entry.
type PermitPool ¶ added in v0.4.0
type PermitPool struct {
// contains filtered or unexported fields
}
PermitPool is a wrapper around a semaphore library to keep things agnostic
func NewPermitPool ¶ added in v0.4.0
func NewPermitPool(permits int) *PermitPool
NewPermitPool returns a new permit pool with the provided number of permits
func (*PermitPool) Acquire ¶ added in v0.4.0
func (c *PermitPool) Acquire()
Acquire returns when a permit has been acquired
func (*PermitPool) Release ¶ added in v0.4.0
func (c *PermitPool) Release()
Release returns a permit to the pool
type PostgreSQLBackend ¶ added in v0.5.0
type PostgreSQLBackend struct {
// contains filtered or unexported fields
}
PostgreSQL Backend is a physical backend that stores data within a PostgreSQL database.
func (*PostgreSQLBackend) Delete ¶ added in v0.5.0
func (m *PostgreSQLBackend) Delete(fullPath string) error
Delete is used to permanently delete an entry
func (*PostgreSQLBackend) Get ¶ added in v0.5.0
func (m *PostgreSQLBackend) Get(fullPath string) (*Entry, error)
Get is used to fetch and entry.
func (*PostgreSQLBackend) List ¶ added in v0.5.0
func (m *PostgreSQLBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*PostgreSQLBackend) Put ¶ added in v0.5.0
func (m *PostgreSQLBackend) Put(entry *Entry) error
Put is used to insert or update an entry.
type S3Backend ¶ added in v0.2.0
type S3Backend struct {
// contains filtered or unexported fields
}
S3Backend is a physical backend that stores data within an S3 bucket.
type ServiceDiscovery ¶ added in v0.6.0
type ServiceDiscovery interface { // NotifyActiveStateChange is used by Core to notify a backend // capable of ServiceDiscovery that this Vault instance has changed // its status to active or standby. NotifyActiveStateChange() error // NotifySealedStateChange is used by Core to notify a backend // capable of ServiceDiscovery that Vault has changed its Sealed // status to sealed or unsealed. NotifySealedStateChange() error // Run executes any background service discovery tasks until the // shutdown channel is closed. RunServiceDiscovery(shutdownCh ShutdownChannel, advertiseAddr string, activeFunc activeFunction, sealedFunc sealedFunction) error }
ServiceDiscovery is an optional interface that an HABackend can implement. If they do, the state of a backend is advertised to the service discovery network.
type ZookeeperBackend ¶ added in v0.1.2
type ZookeeperBackend struct {
// contains filtered or unexported fields
}
ZookeeperBackend is a physical backend that stores data at specific prefix within Zookeeper. It is used in production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*ZookeeperBackend) Delete ¶ added in v0.1.2
func (c *ZookeeperBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*ZookeeperBackend) Get ¶ added in v0.1.2
func (c *ZookeeperBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*ZookeeperBackend) List ¶ added in v0.1.2
func (c *ZookeeperBackend) List(prefix string) ([]string, error)
List is used ot list all the keys under a given prefix, up to the next prefix.
func (*ZookeeperBackend) LockWith ¶ added in v0.2.0
func (c *ZookeeperBackend) LockWith(key, value string) (Lock, error)
LockWith is used for mutual exclusion based on the given key.
func (*ZookeeperBackend) Put ¶ added in v0.1.2
func (c *ZookeeperBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type ZookeeperHALock ¶ added in v0.2.0
type ZookeeperHALock struct {
// contains filtered or unexported fields
}
ZookeeperHALock is a Zookeeper Lock implementation for the HABackend
func (*ZookeeperHALock) Lock ¶ added in v0.2.0
func (i *ZookeeperHALock) Lock(stopCh <-chan struct{}) (<-chan struct{}, error)
func (*ZookeeperHALock) Unlock ¶ added in v0.2.0
func (i *ZookeeperHALock) Unlock() error