secrets

Documentation

Overview

Package secrets provides an interface for a simple secret store: you ask it for a secret (a byte blob, identifies by some key), and it returns it to you (current version, as well as a bunch of previous versions). Caller are supposed to use the secret for an operation and then forget it (e.g. do not try to store it elsewhere).

Secure storage, retrieval and rotation of secrets is outside of the scope of this interface: it's the responsibility of the implementation.

Index

• Variables
• func Set(c context.Context, s Store) context.Context
• func SetFactory(c context.Context, f Factory) context.Context
• type Factory
• type Key
• type NamedBlob
  • func (b NamedBlob) Clone() NamedBlob
• type Secret
  • func GetSecret(c context.Context, k Key) (Secret, error)
  • func (s Secret) Blobs() []NamedBlob
  • func (s Secret) Clone() Secret
• type StaticStore
  • func (s StaticStore) GetSecret(k Key) (Secret, error)
• type Store
  • func Get(c context.Context) Store

Variables

var (
	// ErrNoStoreConfigured is returned by GetSecret if secret store is not in
	// the context.
	ErrNoStoreConfigured = errors.New("secrets.Store is not in the context")
)

var (
	// ErrNoSuchSecret is returned by Store.GetSecret if it can't find a secret.
	ErrNoSuchSecret = errors.New("secret not found")
)

Functions

func Set

func Set(c context.Context, s Store) context.Context

Set injects the Store object in the context to be returned by Get as is.

func SetFactory

func SetFactory(c context.Context, f Factory) context.Context

SetFactory sets the function to produce Store instances when Get(c) is used.

Types

type Factory

type Factory func(context.Context) Store

Factory knows how to make a new Store.

type Key

type Key string

Key names a secret.

type NamedBlob

type NamedBlob struct {
	ID   string // short human readable URL safe string
	Blob []byte // actual secret blob, size depends on Store implementation
}

NamedBlob is byte buffer with an ID string that identifies this particular version of the secret.

func (NamedBlob) Clone

func (b NamedBlob) Clone() NamedBlob

Clone makes a deep copy of the NamedBlob.

type Secret

type Secret struct {
	Current  NamedBlob   // current value of the secret, always set
	Previous []NamedBlob // optional list of previous values, most recent first
}

Secret represents a current value of a secret as well as a set of few previous values. Previous values are important when key is being rotated: there may be valid outstanding derivatives of previous values of the secret.

Each value (current and previous) have an identifier that can be put into derived messages to name specific version of the value.

func GetSecret

func GetSecret(c context.Context, k Key) (Secret, error)

GetSecret is shortcut for grabbing a Store from the context and using its GetSecret method. If the context doesn't have Store set, returns ErrNoStoreConfigured.

func (Secret) Blobs

func (s Secret) Blobs() []NamedBlob

Blobs returns current blob and all previous blobs as one array.

func (Secret) Clone

func (s Secret) Clone() Secret

Clone makes a deep copy of the Secret.

type StaticStore

type StaticStore map[Key]Secret

StaticStore is Store with predefined secrets.

func (StaticStore) GetSecret

func (s StaticStore) GetSecret(k Key) (Secret, error)

GetSecret returns a copy of a secret given its key or ErrNoSuchSecret if no such secret.

type Store

type Store interface {
	// GetSecret returns a secret given its key. Store may choose to autogenerate
	// a secret if there's no existing one, or it may choose to treat it as a
	// error and return ErrNoSuchSecret. Returned secret is always a mutable copy
	// of an actual secret in the Store's gut (just a precaution against
	// unintended modifications of arrays that back all byte blobs).
	GetSecret(Key) (Secret, error)
}

Store knows how to retrieve (or autogenerate) a secret given its key.

func Get

func Get(c context.Context) Store

Get grabs a Store by calling Factory stored in the context. If one hasn't been set, it returns nil.