vault

package
v1.2.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 23, 2024 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const NoCheckAndSet = -1
View Source 
const UnitTestIgnoreVaultAddr = "UnitTestIgnoreVaultAddr"

Variables

View Source 
var DefaultJwkRefreshDelay = 5 * time.Minute
View Source 
var JwkUpdateDelay = 5 * time.Second
View Source 
var SetupRegionScript []byte
View Source 
var SetupScript []byte

Functions

func DeleteData 

func DeleteData(config *Config, path string) error

func DeleteKV 

func DeleteKV(client *api.Client, path string) error

func FindKeychainSecret 

func FindKeychainSecret(account, server string) (string, error)

Find a secret from keychain on OS X. Calling this function will typically prompt the user to enter their account password. This should only be used for local laptop testing.

func GetData 

func GetData(config *Config, path string, version int, data interface{}) error

func GetEnvVars 

func GetEnvVars(config *Config, path string) (map[string]string, error)

func GetKV 

func GetKV(client *api.Client, path string, version int) (map[string]interface{}, error)

func IsCheckAndSetError 

func IsCheckAndSetError(err error) bool

func IsErrNoSecretsAtPath 

func IsErrNoSecretsAtPath(err error) bool

func IsErrUpgradingNonVersionedToVersionedData 

func IsErrUpgradingNonVersionedToVersionedData(err error) bool

IsErrUpgradingNonVersionedToVersionedData can happen right after start-up during a read to the KV secrets engine. A wait or retry is apparently the recommended recourse by Hashicorp. See https://github.com/hashicorp/terraform-provider-vault/issues/677.

func ListData 

func ListData(config *Config, mountPath, path string, recurse bool) ([]string, error)

ListData lists which secrets are under the given path directory. NB: None of the services actually have "list" permissions in their approles so this can't be used at the moment.

func NewClient 

func NewClient(addr string) (*api.Client, error)

func PutData 

func PutData(config *Config, path string, data interface{}) error

func PutDataCAS 

func PutDataCAS(config *Config, path string, data interface{}, checkAndSet int) error

Check and set: -1 to ignore 0: write only allowed if key doesn't exist 1+: write only allowed if cas matches the current version of the secret

func PutKV 

func PutKV(client *api.Client, path string, data map[string]interface{}) error

func PutSecret 

func PutSecret(config *Config, region, name, secret, refresh string) error

func SignSSHKey 

func SignSSHKey(config *Config, publicKey string) (string, error)

func SplitKVPath 

func SplitKVPath(fullpath string) (mount, typ, path string, err error)

SplitKVPath splits a full path into it's mount, type, and path components. Type is either "data" or "metadata".

Types

type AppRoleAuth 

type AppRoleAuth struct {
	// contains filtered or unexported fields
}

func NewAppRoleAuth 

func NewAppRoleAuth(roleID, secretID string) *AppRoleAuth

func (*AppRoleAuth) Login 

func (s *AppRoleAuth) Login(client *api.Client) error

func (*AppRoleAuth) Type 

func (s *AppRoleAuth) Type() string

type Auth 

type Auth interface {
	// Login to vault and set the vault token on the client
	Login(client *api.Client) error
	// Return auth type
	Type() string
}

func BestAuth 

func BestAuth(ops ...BestOp) (Auth, error)

BestAuth determines the best auth to use based on the environment.

type BestOp 

type BestOp func(opts *BestOptions)

func WithEnv 

func WithEnv(env env.Env) BestOp

func WithEnvMap 

func WithEnvMap(vars map[string]string) BestOp

type BestOptions 

type BestOptions struct {
	// contains filtered or unexported fields
}

func ApplyOps 

func ApplyOps(ops ...BestOp) *BestOptions

type Claims 

type Claims interface {
	jwt.Claims
	// Get the Key ID with the claims (for VerifyCookie)
	GetKid() (int, error)
	// Set the Key ID with the claims (for GenerateCookie)
	SetKid(int)
}

type Config 

type Config struct {
	Addr string
	Auth Auth
	// contains filtered or unexported fields
}

func BestConfig 

func BestConfig(addr string, ops ...BestOp) (*Config, error)

func NewAppRoleConfig 

func NewAppRoleConfig(addr, roleID, secretID string) *Config

func NewConfig 

func NewConfig(addr string, auth Auth) *Config

func NewUnitTestConfig 

func NewUnitTestConfig(addr string, client *api.Client) *Config

func (*Config) Login 

func (s *Config) Login() (*api.Client, error)

type DummyServer 

type DummyServer struct {
	TestServer *httptest.Server
	Config     *Config
	KVStore    map[string]map[string]interface{}
}

func NewDummyServer 

func NewDummyServer() *DummyServer

NewDummServer for unit testing

type EnvData 

type EnvData struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type GithubAuth 

type GithubAuth struct {
	// contains filtered or unexported fields
}

func NewGithubAuth 

func NewGithubAuth(githubID string) *GithubAuth

GetGithubAuth grabs the github token from keychain on mac OSX. This should only be used for local testing against real cloudlets when running services locally on the mac dev environment (laptop). It is not intended for production use.

func (*GithubAuth) Login 

func (s *GithubAuth) Login(client *api.Client) error

Login to Vault and return the client. This assumes the token used for github developement can also be used to access Vault.

func (*GithubAuth) Type 

func (s *GithubAuth) Type() string

type JWK 

type JWK struct {
	Secret  string
	Refresh string
}

JWK is the data stored in Vault

type JWKS 

type JWKS struct {
	Keys         map[int]*JWK
	Meta         KVMetadata
	RefreshDelay time.Duration
	Mux          sync.Mutex
	Path         string
	Metapath     string
	// contains filtered or unexported fields
}

JWKS stores the multiple versions of data retrieved from Vault, as well as the data needed to access Vault.

func (*JWKS) GenerateCookie 

func (s *JWKS) GenerateCookie(claims Claims) (string, error)

func (*JWKS) GetCurrentKey 

func (s *JWKS) GetCurrentKey() (string, int, bool)

func (*JWKS) GetKey 

func (s *JWKS) GetKey(version int) (string, bool)

func (*JWKS) GoUpdate 

func (s *JWKS) GoUpdate(callerDone chan struct{}, updateDone chan struct{})

GoUpdate starts a go thread to keep the JKWS up to date. A chan struct can be passed in which will be closed once the first iteration is done and the key set was downloaded from Vault.

func (*JWKS) Init 

func (s *JWKS) Init(config *Config, region, name string)

func (*JWKS) SetLastUpdateAttempt 

func (s *JWKS) SetLastUpdateAttempt(t time.Time)

For testing or debug only

func (*JWKS) UpdateKeys 

func (s *JWKS) UpdateKeys() error

func (*JWKS) VerifyCookie 

func (s *JWKS) VerifyCookie(cookie string, claims Claims) (*jwt.Token, error)

type KVData 

type KVData struct {
	Metadata KVMeta
	Data     map[string]interface{}
}

KVData is the data from the normal get path

func ParseData 

func ParseData(data map[string]interface{}) (*KVData, error)

type KVJWK 

type KVJWK struct {
	Meta KVMeta `mapstructure:"metadata"`
	Data JWK    `mapstructure:"data"`
}

KVJWK represents the kv data in vault returned by a specific version request

type KVMeta 

type KVMeta struct {
	CreatedTime  string `mapstructure:"created_time"`
	DeletionTime string `mapstructure:"deletion_time"`
	Destroyed    bool
	Version      int
}

type KVMetadata 

type KVMetadata struct {
	CurrentVersion int `mapstructure:"current_version"`
	MaxVersions    int `mapstructure:"max_versions"`
	OldestVersion  int `mapstructure:"oldest_version"`
	Versions       map[int]KVMeta
}

KVMetadata is the metadata from the metadata path

func ParseMetadata 

func ParseMetadata(data map[string]interface{}) (*KVMetadata, error)

type LdapAuth 

type LdapAuth struct {
	// contains filtered or unexported fields
}

func NewLdapAuth 

func NewLdapAuth(username, password string) *LdapAuth

func (*LdapAuth) Login 

func (s *LdapAuth) Login(client *api.Client) error

func (*LdapAuth) Type 

func (s *LdapAuth) Type() string

type MEXKey 

type MEXKey struct {
	PrivateKey string `mapstructure:"private_key"`
	PublicKey  string `mapstructure:"public_key"`
}

type NoAuth 

type NoAuth struct{}

NoAuth skips any auth. It is used for unit testing against a fake httptest server.

func (*NoAuth) Login 

func (s *NoAuth) Login(client *api.Client) error

func (*NoAuth) Type 

func (s *NoAuth) Type() string

type PublicCert 

type PublicCert struct {
	Cert string `json:"cert"`
	Key  string `json:"key"`
	TTL  int64  `json:"ttl"` // in seconds
}

func GetPublicCert 

func GetPublicCert(config *Config, commonName string) (*PublicCert, error)

type TokenAuth 

type TokenAuth struct {
	// contains filtered or unexported fields
}

func NewTokenAuth 

func NewTokenAuth(token string) *TokenAuth

func (*TokenAuth) Login 

func (s *TokenAuth) Login(client *api.Client) error

func (*TokenAuth) Type 

func (s *TokenAuth) Type() string

type VaultEnvData 

type VaultEnvData struct {
	Env []EnvData `json:"env"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.