config

Documentation

Index

• Constants
• type Bastion
• type ClientConfig
• type Config
  • func DefaultConfig() (*Config, error)
  • func FromFile(file string) (*Config, error)
  • func (c *Config) GetAWSUsername(ctx context.Context, awsClient *cziAWS.Client) (string, error)
  • func (c *Config) GetKMSAuthCachePath(region string) (string, error)
  • func (c *Config) GetOktaMFADevice() string
  • func (c *Config) GetRemoteUsers(ctx context.Context, username string) []string
  • func (c *Config) Persist() error
  • func (c *Config) SetAWSUsernameIfMissing(ctx context.Context, awsClient *cziAWS.Client) error
• type Duration
  • func (d Duration) AsDuration() time.Duration
• type Honeycomb
• type Host
• type LambdaConfig
• type OktaConfig
• type Region
• type SSHConfig
  • func (s *SSHConfig) String() (string, error)
• type Telemetry

Constants

const (
	// DefaultConfigFile is the default file where blessclient will look for its config
	DefaultConfigFile = "~/.blessclient/config.yml"

	// DefaultSSHPrivateKey is a path to where users usually keep an ssh key
	DefaultSSHPrivateKey = "~/.ssh/id_ed25519"
)

Types

type Bastion

type Bastion struct {
	Host `yaml:",inline"`

	Hosts        []Host `yaml:"hosts"`
	IdentityFile string `yaml:"identity_file"`
	User         string `yaml:"user"`
}

Bastion is an internet accessibly server used to "jump" to other servers

type ClientConfig

type ClientConfig struct {
	// ConfigFile is the path to blessclient config file
	ConfigFile string

	// AWSUserProfile is an aws profile that references a user (not a role)
	// leaving this empty typically means use `default` profile
	AWSUserProfile string ` yaml:"aws_user_profile"`
	// AWSUserName is your AWS username
	AWSUserName *string ` yaml:"aws_username,omitempty"`

	// Path to your ssh private key
	SSHPrivateKey  string `yaml:"ssh_private_key"`
	UpdateSSHAgent bool   `yaml:"update_ssh_agent"`

	// cert related
	CertLifetime Duration `yaml:"cert_lifetime,inline"`
	// ask bless to sign for these remote users
	RemoteUsers []string `yaml:"remote_users"`
	// bless calls these bastion ips - your source ip. 0.0.0.0/0 is all
	BastionIPS []string `yaml:"bastion_ips"`
}

ClientConfig is the client config

type Config

type Config struct {
	// Version versions this config
	Version int `yaml:"version"`

	// ClientConfig is config for blessclient
	ClientConfig ClientConfig `yaml:"client_config"`
	// LambdaConfig holds configuration around the bless lambda
	LambdaConfig LambdaConfig `yaml:"lambda_config"`
	// OktaConfig holds configuration around aws-okta settings
	OktaConfig *OktaConfig `yaml:"okta_config,omitempty"`
	// For convenience, you can bundle an ~/.ssh/config template here
	SSHConfig *SSHConfig `yaml:"ssh_config,omitempty"`

	// Telemetry does telemetry
	Telemetry Telemetry `yaml:"telemetry,omitempty"`
}

Config is a blessclient config

func DefaultConfig

func DefaultConfig() (*Config, error)

DefaultConfig generates a config with some defaults

func FromFile

func FromFile(file string) (*Config, error)

FromFile reads the config from file

func (*Config) GetAWSUsername

func (c *Config) GetAWSUsername(ctx context.Context, awsClient *cziAWS.Client) (string, error)

GetAWSUsername gets the caller's aws username for kmsauth

func (*Config) GetKMSAuthCachePath

func (c *Config) GetKMSAuthCachePath(region string) (string, error)

GetKMSAuthCachePath gets a path to kmsauth cache file kmsauth is regional

func (*Config) GetOktaMFADevice

func (c *Config) GetOktaMFADevice() string

GetOktaMFADevice gets the user's designated MFA device, defaulting to "phone1" (phone-based MFA).

func (*Config) GetRemoteUsers

func (c *Config) GetRemoteUsers(ctx context.Context, username string) []string

GetRemoteUsers gets the list of remote usernames, defaulting to the provided username if the list of configured remote users is empty.

func (*Config) Persist

func (c *Config) Persist() error

Persist persists a config to disk

func (*Config) SetAWSUsernameIfMissing

func (c *Config) SetAWSUsernameIfMissing(ctx context.Context, awsClient *cziAWS.Client) error

SetAWSUsernameIfMissing queries AWS for the username and sets it in the config if missing

type Duration

type Duration struct {
	time.Duration
}

Duration is a wrapper around Duration to marshal/unmarshal

func (Duration) AsDuration

func (d Duration) AsDuration() time.Duration

AsDuration returns as duration

type Honeycomb

type Honeycomb struct {
	WriteKey string `yaml:"write_key,omitempty"`
	Dataset  string `yaml:"dataset,omitempty"`
	// SecretManagerARN is a secret that holds the honeycomb write key
	SecretManagerARN string `yaml:"secret_manager_arn,omitempty"`
}

Honeycomb telemetry configuration

type Host

type Host struct {
	Pattern string `yaml:"pattern"`
}

Host represents a Host block in an ssh config

type LambdaConfig

type LambdaConfig struct {
	// RoleARN used to assume and invoke bless lambda
	RoleARN *string `yaml:"role_arn,omitempty"`
	// Bless lambda function name
	FunctionName string `yaml:"function_name"`
	// Bless lambda function version (lambda alias or version qualifier)
	FunctionVersion *string `yaml:"function_version,omitempty"`
	// bless lambda regions
	Regions []Region `yaml:"regions,omitempty"`
}

LambdaConfig is the lambda config

type OktaConfig

type OktaConfig struct {
	Domain       string  `yaml:"domain"`
	Organization string  `yaml:"organization"`
	Profile      string  `yaml:"profile"`
	MFADevice    *string `yaml:"mfa_device,omitempty"`
	KeyringKeyID *string `yaml:"keyring_key_id,omitempty"`
}

OktaConfig is the Okta config

type Region

type Region struct {
	// name of the aws region (us-west-2)
	AWSRegion string `yaml:"aws_region"`
	// region specific kms key id (not arn) of the key used for kmsauth
	KMSAuthKeyID string `yaml:"kms_auth_key_id"`
}

Region is an aws region that contains an aws lambda

type SSHConfig

type SSHConfig struct {
	Bastions []Bastion `yaml:"bastions"`
}

SSHConfig is an SSH config We make some assumptions here around the structure of the machines A bastion is internet accessible and can be used to reach other machines

func (*SSHConfig) String

func (s *SSHConfig) String() (string, error)

String generates the ssh config string

type Telemetry

type Telemetry struct {
	Honeycomb *Honeycomb `yaml:"honeycomb,omitempty"`
}

Telemetry to track adoption, performance, errors