secrets

Documentation

Overview

Package secrets provides mechanisms for referring to and accessing sensitive information, NOT including cryptographic keys. These can be, for example, passwords, API tokens, or OAuth client secrets.

Index

• type Option
  • func GCPOption(o option.ClientOption) Option
• type Secret
  • func (s *Secret) Fetch(ctx context.Context, opts ...Option) ([]byte, error)
  • func (s *Secret) Set(raw string) error
  • func (s *Secret) String() string
  • func (s *Secret) Type() string
• type Source

Types

type Option

type Option interface {
	// contains filtered or unexported methods
}

An Option configures behaviour of Secret.Fetch().

func GCPOption

func GCPOption(o option.ClientOption) Option

GCPOption returns a Fetch() Option indicating that the secretmanger.Client used to fetch the secret must use the ClientOption.

type Secret

type Secret struct {
	Source Source
	ID     string
}

A Secret identifies a secret but doesn't carry the value itself.

func (*Secret) Fetch

func (s *Secret) Fetch(ctx context.Context, opts ...Option) ([]byte, error)

Fetch fetches and returns the Secret's payload. It ignores all Options that aren't relevant to s.Source; for example, passing a GCPOption with an environment variable is allowed.

func (*Secret) Set

func (s *Secret) Set(raw string) error

Set is the inverse of s.String(). Together, these mean that *Secret implements flag.Value, for use with flag.Var().

func (*Secret) String

func (s *Secret) String() string

String returns <s.Source>://<s.ID>; e.g. env://MY_VAR to describe $MY_VAR. If the secret is nil, this will return an invalid secret string.

func (*Secret) Type

func (s *Secret) Type() string

Type returns the fully qualified type of s. Required for use with pflag to implement the pflag.Value interface.

type Source

type Source string

A Sources defines the source of the secret.

const (
	// The Raw Source carries a raw, unprotected "secret"; it MUST NOT be used
	// for sensitive data, and is exposed to allow raw data when a Secret string
	// is expected.
	Raw Source = "not-secret"
	// The GCP Source fetches secrets from the GCP Secrets Manager.
	GCP Source = "gcp"
	// The Environment Source fetches secrets from an environment variable.
	Environment Source = "env"
)