vault

package module
v0.0.0-...-b171ee9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 26, 2022 License: MIT Imports: 10 Imported by: 0

README

Golang Library for HashiCorp vault

Go Doc Release Go

This is yet another golang vault client. It uses the official vault go client but adds some requests and responses types and some convenient methods for an improved Developing experience.

Typing every request and response is rather time consuming, only a few vault APIs are implemented at the moment. If there is demand for us to use other APIs, they will be added. We are also always open to Pull Requests :)

Supported APIs

Currently, these APIs are implemented:

  • Transit(mountPoint)

Authentication

Token-based and Kubernetes Auth are supported as of now.

Token-Based

Initialize a new Vault Client using your token and endpoint:

Example

Kubernetes In-Cluster Example

Example

Usage

Once the Vault Client is created, instanciate new clients for each engine:

TransitList Example

Transit Encrypt/Decrypt Example

Run Tests

Tests require a running docker daemon. The test will automatically create a vault container.

> make test

Documentation

Overview

Example (EncryptDecryptType) 
const rsa4096 = "rsa-4096"
c, err := NewClient("https://vault:8200/", WithCaPath(""), WithAuthToken("test"))
if err != nil {
	log.Fatal(err)
}

fmt.Println(c.Token())

transit := c.Transit()

key := "test123bacd"

err = transit.Create(key, &TransitCreateOptions{
	Exportable: BoolPtr(true),
	Type:       rsa4096,
})
if err != nil {
	log.Fatal(err)
}

res, err := transit.Read(key)
if err != nil {
	log.Fatal(err)
} else {
	log.Printf("%+v\n", res.Data)
}

exportRes, err := transit.Export(key, TransitExportOptions{
	KeyType: "encryption-key",
})
if err != nil {
	log.Fatal(err)
}
log.Printf("%v+", exportRes.Data.Keys[1])

encryptResponse, err := transit.Encrypt(key, &TransitEncryptOptions{
	Plaintext: "plaintext",
})
if err != nil {
	log.Fatalf("Error occurred during encryption: %v", err)
}
log.Println("Ciphertext: ", encryptResponse.Data.Ciphertext)

decryptResponse, err := transit.Decrypt(key, &TransitDecryptOptions{
	Ciphertext: encryptResponse.Data.Ciphertext,
})
if err != nil {
	log.Fatalf("Error occurred during decryption: %v", err)
}
log.Println("Plaintext: ", decryptResponse.Data.Plaintext)

Output:
Example (K8sInCluster) 
c, err := NewClient("https://vault:8200/", WithCaPath(""), WithKubernetesAuth("myrole"))
if err != nil {
	log.Fatal(err)
}

log.Println(c.Address())

Output:
Example (TokenBased) 
c, err := NewClient("https://vault:8200/",
	WithCaPath(""),
	WithAuthToken("SECRET"),
)
if err != nil {
	log.Fatal(err)
}

log.Println(c.Address())

Output:

Index

Examples

Constants

This section is empty.

Variables

View Source 
var (
	ErrEncKeyNotFound = errors.New("encryption key not found")
)

Functions

func BoolPtr 

func BoolPtr(input bool) *bool

func IntPtr 

func IntPtr(input int) *int

func StringPtr 

func StringPtr(input string) *string

Types

type AuthProvider 

type AuthProvider interface {
	Auth() (*AuthResponse, error)
}

func NewKubernetesAuth 

func NewKubernetesAuth(c *Client, role string, opts ...KubernetesAuthOpt) (AuthProvider, error)

type AuthResponse 

type AuthResponse struct {
	Auth struct {
		ClientToken   string   `json:"client_token"`
		Accessor      string   `json:"accessor"`
		Policies      []string `json:"policies"`
		LeaseDuration int      `json:"lease_duration"`
		Renewable     bool     `json:"renewable"`
		Metadata      struct {
			Role                     string `json:"role"`
			ServiceAccountName       string `json:"service_account_name"`
			ServiceAccountNamespace  string `json:"service_account_namespace"`
			ServiceAccountSecretName string `json:"service_account_secret_name"`
			ServiceAccountUID        string `json:"service_account_uid"`
		} `json:"metadata"`
	} `json:"auth"`
}

type Client 

type Client struct {
	*api.Client
	// contains filtered or unexported fields
}

func NewClient 

func NewClient(addr string, tlsConf *TLSConfig, opts ...ClientOpts) (*Client, error)

func (*Client) Delete 

func (c *Client) Delete(path []string, body, response interface{}, opts *RequestOptions) error

func (*Client) List 

func (c *Client) List(path []string, body, response interface{}, opts *RequestOptions) error

func (*Client) Read 

func (c *Client) Read(path []string, response interface{}, opts *RequestOptions) error

func (*Client) Request 

func (c *Client) Request(method string, path []string, body, response interface{}, opts *RequestOptions) error

func (*Client) Transit 

func (c *Client) Transit() *Transit

func (*Client) TransitWithMountPoint 

func (c *Client) TransitWithMountPoint(mountPoint string) *Transit

func (*Client) Write 

func (c *Client) Write(path []string, body, response interface{}, opts *RequestOptions) error

type ClientOpts 

type ClientOpts func(c *Client) error

func WithAuthToken 

func WithAuthToken(token string) ClientOpts

func WithKubernetesAuth 

func WithKubernetesAuth(role string, opts ...KubernetesAuthOpt) ClientOpts

type KubernetesAuthOpt 

type KubernetesAuthOpt func(k *kubernetesAuth) error

func WithJwt 

func WithJwt(jwt string) KubernetesAuthOpt

func WithJwtFromFile 

func WithJwtFromFile(path string) KubernetesAuthOpt

func WithMountPoint 

func WithMountPoint(mountPoint string) KubernetesAuthOpt

type RequestOptions 

type RequestOptions struct {
	Parameters url.Values

	// SkipRenewal defines if the client should retry this Request with a new Token if it fails because of
	// 403 Permission Denied
	// The default behavior of the client is to always Request a new Token on 403
	// Only if this is explicitly set to true, the client will continue processing the first failed request
	// and skip the renewal
	// This should generally only be disabled for TokenAuth requests (a failed TokenAuth request can't be fixed by
	// doing another TokenAuth request, this would lead to infinite recursion)
	SkipRenewal bool
}

type Service 

type Service struct {
	MountPoint string
	// contains filtered or unexported fields
}

type TLSConfig 

type TLSConfig struct {
	*api.TLSConfig
}

func WithCaCert 

func WithCaCert(cert string) *TLSConfig

func WithCaPath 

func WithCaPath(path string) *TLSConfig

type Transit 

type Transit struct {
	Service
}

func (*Transit) Create 

func (t *Transit) Create(key string, opts *TransitCreateOptions) error

func (*Transit) Decrypt 

func (t *Transit) Decrypt(key string, opts *TransitDecryptOptions) (*TransitDecryptResponse, error)

func (*Transit) DecryptBatch 

func (t *Transit) DecryptBatch(key string, opts TransitDecryptOptionsBatch) (*TransitDecryptResponseBatch, error)

func (*Transit) Delete 

func (t *Transit) Delete(key string) error

func (*Transit) Encrypt 

func (t *Transit) Encrypt(key string, opts *TransitEncryptOptions) (*TransitEncryptResponse, error)

func (*Transit) EncryptBatch 

func (t *Transit) EncryptBatch(key string, opts *TransitEncryptOptionsBatch) (*TransitEncryptResponseBatch, error)

func (*Transit) Export 

func (t *Transit) Export(key string, opts TransitExportOptions) (*TransitExportResponse, error)

func (*Transit) ForceDelete 

func (t *Transit) ForceDelete(key string) error

func (*Transit) KeyExists 

func (t *Transit) KeyExists(key string) (bool, error)

func (*Transit) List 

func (t *Transit) List() (*TransitListResponse, error)
Example 
c, err := NewClient("https://vault:8200/",
	WithCaPath(""),
	WithAuthToken("SECRET"),
)
if err != nil {
	log.Fatal(err)
}

l, err := c.TransitWithMountPoint("transit").List()
if err != nil {
	log.Fatal()
}

log.Println(l)

Output:

func (*Transit) Read 

func (t *Transit) Read(key string) (*TransitReadResponse, error)

func (*Transit) Rotate 

func (t *Transit) Rotate(key string) error

func (*Transit) Sign 

func (t *Transit) Sign(key string, opts *TransitSignOptions) (*TransitSignResponse, error)

func (*Transit) Update 

func (t *Transit) Update(key string, opts TransitUpdateOptions) error

func (*Transit) Verify 

func (t *Transit) Verify(key string, opts *TransitVerifyOptions) (*TransitVerifyResponse, error)

type TransitBatchCiphertext 

type TransitBatchCiphertext struct {
	Ciphertext string `json:"ciphertext"`
	Context    string `json:"context,omitempty"`
}

type TransitBatchPlaintext 

type TransitBatchPlaintext struct {
	Plaintext string `json:"plaintext"`
	Context   string `json:"context,omitempty"`
}

type TransitCreateOptions 

type TransitCreateOptions struct {
	ConvergentEncryption *bool  `json:"convergent_encryption,omitempty"`
	Derived              *bool  `json:"derived,omitempty"`
	Exportable           *bool  `json:"exportable,omitempty"`
	AllowPlaintextBackup *bool  `json:"allow_plaintext_backup,omitempty"`
	Type                 string `json:"type,omitempty"`
}

type TransitDecryptOptions 

type TransitDecryptOptions struct {
	Ciphertext string `json:"ciphertext"`
	Context    string `json:"context,omitempty"`
	Nonce      string `json:"nonce,omitempty"`
}

type TransitDecryptOptionsBatch 

type TransitDecryptOptionsBatch struct {
	BatchInput []TransitBatchCiphertext `json:"batch_input"`
}

type TransitDecryptResponse 

type TransitDecryptResponse struct {
	Data struct {
		Plaintext string `json:"plaintext"`
	} `json:"data"`
}

type TransitDecryptResponseBatch 

type TransitDecryptResponseBatch struct {
	Data struct {
		BatchResults []TransitBatchPlaintext `json:"batch_results"`
	} `json:"data"`
}

type TransitEncryptOptions 

type TransitEncryptOptions struct {
	Plaintext            string `json:"plaintext"`
	Context              string `json:"context,omitempty"`
	KeyVersion           *int   `json:"key_version,omitempty"`
	Nonce                string `json:"nonce,omitempty"`
	Type                 string `json:"type,omitempty"`
	ConvergentEncryption string `json:"convergent_encryption,omitempty"`
}

type TransitEncryptOptionsBatch 

type TransitEncryptOptionsBatch struct {
	BatchInput           []TransitBatchPlaintext `json:"batch_input"`
	KeyVersion           *int                    `json:"key_version,omitempty"`
	Type                 string                  `json:"type,omitempty"`
	ConvergentEncryption string                  `json:"convergent_encryption,omitempty"`
}

type TransitEncryptResponse 

type TransitEncryptResponse struct {
	Data struct {
		Ciphertext string `json:"ciphertext"`
	} `json:"data"`
}

type TransitEncryptResponseBatch 

type TransitEncryptResponseBatch struct {
	Data struct {
		BatchResults []TransitBatchCiphertext `json:"batch_results"`
	} `json:"data"`
}

type TransitExportOptions 

type TransitExportOptions struct {
	KeyType string `json:"key_type"`
	Version string `json:"version,omitempty"`
}

type TransitExportResponse 

type TransitExportResponse struct {
	Data struct {
		Name string         `json:"name"`
		Keys map[int]string `json:"keys"`
		Type string         `json:"type"`
	} `json:"data"`
}

type TransitListResponse 

type TransitListResponse struct {
	Data struct {
		Keys []string `json:"keys"`
	} `json:"data"`
}

type TransitReadResponse 

type TransitReadResponse struct {
	Data TransitReadResponseData `json:"data"`
}

type TransitReadResponseData 

type TransitReadResponseData struct {
	Name                 string              `json:"name"`
	Type                 string              `json:"type"`
	Keys                 map[int]interface{} `json:"keys"`
	MinDecryptionVersion int                 `json:"min_decrytion_version"`
	MinEncryptionVersion int                 `json:"min_encryption_version"`
	LatestVersion        int                 `json:"latest_version"`
	DeletionAllowed      bool                `json:"deletion_allowed"`
	Derived              bool                `json:"derived"`
	Exportable           bool                `json:"exportable"`
	AllowPlaintextBackup bool                `json:"allow_plaintext_backup"`
	SupportsEncryption   bool                `json:"supports_encryption"`
	SupportsDecryption   bool                `json:"supports_decryption"`
	SupportsDerivation   bool                `json:"supports_derivation"`
	SupportsSigning      bool                `json:"supports_signing"`
}

type TransitSignOptions 

type TransitSignOptions struct {
	Plaintext string `json:"input"`
}

type TransitSignResponse 

type TransitSignResponse struct {
	Data struct {
		Signature string `json:"signature"`
	} `json:"data"`
}

type TransitUpdateOptions 

type TransitUpdateOptions struct {
	MinDecryptionVersion int   `json:"min_decrytion_version,omitempty"`
	MinEncryptionVersion int   `json:"min_encryption_version,omitempty"`
	DeletionAllowed      *bool `json:"deletion_allowed,omitempty"`
	Exportable           *bool `json:"exportable,omitempty"`
	AllowPlaintextBackup *bool `json:"allow_plaintext_backup,omitempty"`
}

type TransitVerifyOptions 

type TransitVerifyOptions struct {
	Plaintext string `json:"input"`
	Signature string `json:"signature"`
}

type TransitVerifyResponse 

type TransitVerifyResponse struct {
	Data struct {
		Valid bool `json:"valid"`
	} `json:"data"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.