conjur

Documentation

Overview

Package conjur provides a Conjur provider for External Secrets.

Package conjur provides a Conjur provider for External Secrets.

Index

• Constants
• type Client
  • func (c *Client) Close(_ context.Context) error
  • func (c *Client) DeleteSecret(_ context.Context, _ esv1beta1.PushSecretRemoteRef) error
  • func (c *Client) GetAllSecrets(ctx context.Context, ref esv1beta1.ExternalSecretFind) (map[string][]byte, error)
  • func (c *Client) GetConjurClient(ctx context.Context) (SecretsClient, error)
  • func (c *Client) GetSecret(ctx context.Context, ref esv1beta1.ExternalSecretDataRemoteRef) ([]byte, error)
  • func (c *Client) GetSecretMap(ctx context.Context, ref esv1beta1.ExternalSecretDataRemoteRef) (map[string][]byte, error)
  • func (c *Client) PushSecret(_ context.Context, _ *corev1.Secret, _ esv1beta1.PushSecretData) error
  • func (c *Client) SecretExists(_ context.Context, _ esv1beta1.PushSecretRemoteRef) (bool, error)
  • func (c *Client) Validate() (esv1beta1.ValidationResult, error)
• type ClientAPIImpl
  • func (c *ClientAPIImpl) NewClientFromJWT(config conjurapi.Config, jwtToken, jwtServiceID, jwtHostID string) (SecretsClient, error)
  • func (c *ClientAPIImpl) NewClientFromKey(config conjurapi.Config, loginPair authn.LoginPair) (SecretsClient, error)
• type Provider
  • func (p *Provider) Capabilities() esv1beta1.SecretStoreCapabilities
  • func (p *Provider) NewClient(ctx context.Context, store esv1beta1.GenericStore, kube client.Client, ...) (esv1beta1.SecretsClient, error)
  • func (p *Provider) ValidateStore(store esv1beta1.GenericStore) (admission.Warnings, error)
• type SecretsClient
• type SecretsClientFactory

Constants

const JwtLifespan = 600 // 10 minutes

Types

type Client

type Client struct {
	StoreKind string
	// contains filtered or unexported fields
}

Client is a provider for Conjur.

func (*Client) Close

func (c *Client) Close(_ context.Context) error

Close closes the provider.

func (*Client) DeleteSecret

func (c *Client) DeleteSecret(_ context.Context, _ esv1beta1.PushSecretRemoteRef) error

func (*Client) GetAllSecrets

func (c *Client) GetAllSecrets(ctx context.Context, ref esv1beta1.ExternalSecretFind) (map[string][]byte, error)

GetAllSecrets gets multiple secrets from the provider and loads into a kubernetes secret. First load all secrets from secretStore path configuration Then, gets secrets from a matching name or matching custom_metadata.

func (*Client) GetConjurClient

func (c *Client) GetConjurClient(ctx context.Context) (SecretsClient, error)

func (*Client) GetSecret

func (c *Client) GetSecret(ctx context.Context, ref esv1beta1.ExternalSecretDataRemoteRef) ([]byte, error)

GetSecret returns a single secret from the provider.

func (*Client) GetSecretMap

func (c *Client) GetSecretMap(ctx context.Context, ref esv1beta1.ExternalSecretDataRemoteRef) (map[string][]byte, error)

GetSecretMap returns multiple k/v pairs from the provider.

func (*Client) PushSecret

func (c *Client) PushSecret(_ context.Context, _ *corev1.Secret, _ esv1beta1.PushSecretData) error

PushSecret will write a single secret into the provider.

func (*Client) SecretExists

func (c *Client) SecretExists(_ context.Context, _ esv1beta1.PushSecretRemoteRef) (bool, error)

func (*Client) Validate

func (c *Client) Validate() (esv1beta1.ValidationResult, error)

Validate validates the provider.

type ClientAPIImpl

type ClientAPIImpl struct{}

ClientAPIImpl is an implementation of the ClientAPI interface.

func (*ClientAPIImpl) NewClientFromJWT

func (c *ClientAPIImpl) NewClientFromJWT(config conjurapi.Config, jwtToken, jwtServiceID, jwtHostID string) (SecretsClient, error)

NewClientFromJWT creates a new Conjur client from a JWT token. cannot use the built-in function "conjurapi.NewClientFromJwt" because it requires environment variables see: https://github.com/cyberark/conjur-api-go/blob/b698692392a38e5d38b8440f32ab74206544848a/conjurapi/client.go#L130

func (*ClientAPIImpl) NewClientFromKey

func (c *ClientAPIImpl) NewClientFromKey(config conjurapi.Config, loginPair authn.LoginPair) (SecretsClient, error)

type Provider

type Provider struct {
	NewConjurProvider func(context context.Context, store esv1beta1.GenericStore, kube client.Client, namespace string, corev1 typedcorev1.CoreV1Interface, clientApi SecretsClientFactory) (esv1beta1.SecretsClient, error)
}

func (*Provider) Capabilities

func (p *Provider) Capabilities() esv1beta1.SecretStoreCapabilities

Capabilities returns the provider Capabilities (Read, Write, ReadWrite).

func (*Provider) NewClient

func (p *Provider) NewClient(ctx context.Context, store esv1beta1.GenericStore, kube client.Client, namespace string) (esv1beta1.SecretsClient, error)

NewClient creates a new Conjur client.

func (*Provider) ValidateStore

func (p *Provider) ValidateStore(store esv1beta1.GenericStore) (admission.Warnings, error)

ValidateStore validates the store.

type SecretsClient

type SecretsClient interface {
	RetrieveSecret(secret string) (result []byte, err error)
	RetrieveBatchSecrets(variableIDs []string) (map[string][]byte, error)
	Resources(filter *conjurapi.ResourceFilter) (resources []map[string]interface{}, err error)
}

SecretsClient is an interface for the Conjur client.

type SecretsClientFactory

type SecretsClientFactory interface {
	NewClientFromKey(config conjurapi.Config, loginPair authn.LoginPair) (SecretsClient, error)
	NewClientFromJWT(config conjurapi.Config, jwtToken string, jwtServiceID, jwtHostID string) (SecretsClient, error)
}

SecretsClientFactory is an interface for creating a Conjur client.