vault

Documentation

Index

• Variables
• type Arguments
  • func (a *Arguments) SetToDefault()
  • func (a *Arguments) Validate() error
• type AuthAWS
  • func (a *AuthAWS) SetToDefault()
  • func (a *AuthAWS) Validate() error
• type AuthAppRole
  • func (a *AuthAppRole) SetToDefault()
• type AuthArguments
• type AuthAzure
  • func (a *AuthAzure) SetToDefault()
• type AuthCustom
  • func (a *AuthCustom) Login(ctx context.Context, client *vault.Client) (*vault.Secret, error)
• type AuthGCP
  • func (a *AuthGCP) SetToDefault()
  • func (a *AuthGCP) Validate() error
• type AuthKubernetes
  • func (a *AuthKubernetes) SetToDefault()
• type AuthLDAP
  • func (a *AuthLDAP) SetToDefault()
• type AuthToken
• type AuthUserPass
  • func (a *AuthUserPass) SetToDefault()
• type ClientOptions
• type Component
  • func New(opts component.Options, args Arguments) (*Component, error)
  • func (c *Component) CurrentHealth() component.Health
  • func (c *Component) DebugInfo() interface{}
  • func (c *Component) Run(ctx context.Context) error
  • func (c *Component) Update(args component.Arguments) error
• type Exports

Variables

var DefaultArguments = Arguments{
	ClientOptions: ClientOptions{
		MinRetryWait: 1000 * time.Millisecond,
		MaxRetryWait: 1500 * time.Millisecond,
		MaxRetries:   2,
		Timeout:      60 * time.Second,
	},
}

DefaultArguments holds default settings for Arguments.

var DefaultAuthAWS = AuthAWS{
	MountPath:        "aws",
	Type:             authAWSTypeIAM,
	Region:           "us-east-1",
	EC2SignatureType: "pkcs7",
}

DefaultAuthAWS provides default settings for AuthAWS.

var DefaultAuthAppRole = AuthAppRole{
	MountPath: "approle",
}

DefaultAuthAppRole provides default settings for AuthAppRole.

var DefaultAuthAzure = AuthAzure{
	MountPath:   "azure",
	ResourceURL: "https://management.azure.com/",
}

DefaultAuthAzure provides default settings for AuthAzure.

var DefaultAuthGCP = AuthGCP{
	MountPath: "gcp",
	Type:      authGCPTypeGCE,
}

DefaultAuthGCP provides default settings for AuthGCP.

var DefaultAuthKubernetes = AuthKubernetes{
	MountPath:               "kubernetes",
	ServiceAccountTokenFile: "/var/run/secrets/kubernetes.io/serviceaccount/token",
}

DefaultAuthKubernetes provides default settings for AuthKubernetes.

var DefaultAuthLDAP = AuthLDAP{
	MountPath: "ldap",
}

DefaultAuthLDAP provides default settings for AuthLDAP.

var DefaultAuthUserPass = AuthUserPass{
	MountPath: "userpass",
}

DefaultAuthUserPass provides default settings for AuthUserPass.

Types

type Arguments

type Arguments struct {
	Server    string `alloy:"server,attr"`
	Namespace string `alloy:"namespace,attr,optional"`

	Path string `alloy:"path,attr"`

	RereadFrequency time.Duration `alloy:"reread_frequency,attr,optional"`

	ClientOptions ClientOptions `alloy:"client_options,block,optional"`

	Auth []AuthArguments `alloy:"auth,enum,optional"`
}

Arguments configures remote.vault.

func (*Arguments) SetToDefault

func (a *Arguments) SetToDefault()

SetToDefault implements syntax.Defaulter.

func (*Arguments) Validate

func (a *Arguments) Validate() error

Validate implements syntax.Validator.

type AuthAWS

type AuthAWS struct {
	// Type specifies the mechanism used to authenticate with AWS. Should be
	// either ec2 or iam.
	Type              string `alloy:"type,attr"`
	Region            string `alloy:"region,attr,optional"`
	Role              string `alloy:"role,attr,optional"`
	IAMServerIDHeader string `alloy:"iam_server_id_header,attr,optional"`
	// EC2SignatureType specifies the signature to use against EC2. Only used
	// when Type is ec2. Valid options are identity and pkcs7 (default).
	EC2SignatureType string `alloy:"ec2_signature_type,attr,optional"`
	MountPath        string `alloy:"mount_path,attr,optional"`
}

AuthAWS authenticates against Vault with AWS.

func (*AuthAWS) SetToDefault

func (a *AuthAWS) SetToDefault()

SetToDefault implements syntax.Defaulter.

func (*AuthAWS) Validate

func (a *AuthAWS) Validate() error

Validate implements syntax.Validator.

type AuthAppRole

type AuthAppRole struct {
	RoleID        string            `alloy:"role_id,attr"`
	Secret        alloytypes.Secret `alloy:"secret,attr"`
	WrappingToken bool              `alloy:"wrapping_token,attr,optional"`
	MountPath     string            `alloy:"mount_path,attr,optional"`
}

AuthAppRole authenticates against Vault with AppRole.

func (*AuthAppRole) SetToDefault

func (a *AuthAppRole) SetToDefault()

SetToDefault implements syntax.Defaulter.

type AuthArguments

type AuthArguments struct {
	AuthToken      *AuthToken      `alloy:"token,block,optional"`
	AuthAppRole    *AuthAppRole    `alloy:"approle,block,optional"`
	AuthAWS        *AuthAWS        `alloy:"aws,block,optional"`
	AuthAzure      *AuthAzure      `alloy:"azure,block,optional"`
	AuthGCP        *AuthGCP        `alloy:"gcp,block,optional"`
	AuthKubernetes *AuthKubernetes `alloy:"kubernetes,block,optional"`
	AuthLDAP       *AuthLDAP       `alloy:"ldap,block,optional"`
	AuthUserPass   *AuthUserPass   `alloy:"userpass,block,optional"`
	AuthCustom     *AuthCustom     `alloy:"custom,block,optional"`
}

AuthArguments defines a single authenticationstring type in a remote.vault component instance. These are embedded as an enum field so only one may be set per AuthArguments.

type AuthAzure

type AuthAzure struct {
	Role        string `alloy:"role,attr"`
	ResourceURL string `alloy:"resource_url,attr,optional"`
	MountPath   string `alloy:"mount_path,attr,optional"`
}

AuthAzure authenticates against Vault with Azure.

func (*AuthAzure) SetToDefault

func (a *AuthAzure) SetToDefault()

SetToDefault implements syntax.Defaulter.

type AuthCustom

type AuthCustom struct {
	// Path to use for logging in (e.g., auth/kubernetes/login, etc.)
	Path string                       `alloy:"path,attr"`
	Data map[string]alloytypes.Secret `alloy:"data,attr"`
}

AuthCustom provides a custom authentication method.

func (*AuthCustom) Login

func (a *AuthCustom) Login(ctx context.Context, client *vault.Client) (*vault.Secret, error)

Login implements vault.AuthMethod.

type AuthGCP

type AuthGCP struct {
	Role string `alloy:"role,attr"`
	// Type specifies the mechanism used to authenticate with GCS. Should be
	// either gce or iam.
	Type              string `alloy:"type,attr"`
	IAMServiceAccount string `alloy:"iam_service_account,attr,optional"`
	MountPath         string `alloy:"mount_path,attr,optional"`
}

AuthGCP authenticates against Vault with GCP.

func (*AuthGCP) SetToDefault

func (a *AuthGCP) SetToDefault()

SetToDefault implements syntax.Defaulter.

func (*AuthGCP) Validate

func (a *AuthGCP) Validate() error

Validate implements syntax.Validator.

type AuthKubernetes

type AuthKubernetes struct {
	Role                    string `alloy:"role,attr"`
	ServiceAccountTokenFile string `alloy:"service_account_file,attr,optional"`
	MountPath               string `alloy:"mount_path,attr,optional"`
}

AuthKubernetes authenticates against Vault with Kubernetes.

func (*AuthKubernetes) SetToDefault

func (a *AuthKubernetes) SetToDefault()

SetToDefault implements syntax.Defaulter.

type AuthLDAP

type AuthLDAP struct {
	Username  string            `alloy:"username,attr"`
	Password  alloytypes.Secret `alloy:"password,attr"`
	MountPath string            `alloy:"mount_path,attr,optional"`
}

AuthLDAP authenticates against Vault with LDAP.

func (*AuthLDAP) SetToDefault

func (a *AuthLDAP) SetToDefault()

SetToDefault implements syntax.Defaulter.

type AuthToken

type AuthToken struct {
	Token alloytypes.Secret `alloy:"token,attr"`
}

AuthToken authenticates against Vault with a token.

type AuthUserPass

type AuthUserPass struct {
	Username  string            `alloy:"username,attr"`
	Password  alloytypes.Secret `alloy:"password,attr"`
	MountPath string            `alloy:"mount_path,attr,optional"`
}

AuthUserPass authenticates against Vault with a username and password.

func (*AuthUserPass) SetToDefault

func (a *AuthUserPass) SetToDefault()

SetToDefault implements syntax.Defaulter.

type ClientOptions

type ClientOptions struct {
	MinRetryWait time.Duration `alloy:"min_retry_wait,attr,optional"`
	MaxRetryWait time.Duration `alloy:"max_retry_wait,attr,optional"`
	MaxRetries   int           `alloy:"max_retries,attr,optional"`
	Timeout      time.Duration `alloy:"timeout,attr,optional"`
}

ClientOptions sets extra options on the Client.

type Component

type Component struct {
	// contains filtered or unexported fields
}

Component implements the remote.vault component.

func New

func New(opts component.Options, args Arguments) (*Component, error)

New creates a new remote.vault component. It will try to immediately read the secret from Vault and return an error if the secret can't be read or if authentication against the Vault server fails.

func (*Component) CurrentHealth

func (c *Component) CurrentHealth() component.Health

CurrentHealth returns the current health of the remote.vault component. It will be healthy as long as the latest read or renewal was successful.

func (*Component) DebugInfo

func (c *Component) DebugInfo() interface{}

DebugInfo returns debug information about the remote.vault component. It includes non-sensitive metadata about the current secret.

func (*Component) Run

func (c *Component) Run(ctx context.Context) error

Run runs the remote.vault component, managing the lifetime of the retrieved secret and renewing/rereading it as necessary.

func (*Component) Update

func (c *Component) Update(args component.Arguments) error

Update updates the remote.vault component. It will try to immediately read the secret from Vault and return an error if the secret can't be read.

type Exports

type Exports struct {
	// Data holds key-value pairs returned from Vault after retrieving the key.
	// Any keys-value pairs returned from Vault which are not []byte or strings
	// cannot be represented as secrets and are therefore ignored.
	//
	// However, it seems that most secrets engines don't actually return
	// arbitrary data, so this limitation shouldn't cause any issues in practice.
	Data map[string]alloytypes.Secret `alloy:"data,attr"`
}

Exports is the values exported by remote.vault.