vault

Documentation

Index

• Constants
• Variables
• type LogicalClient
• type Secret
  • func NewSecret(commonName, altNames, ipSANs, otherSANs, ttl string) Secret
  • func ParseSecret(ref string) (Secret, error)
  • func (s Secret) String() string
• type SecretClient
  • func NewSecretClient(logger hclog.Logger, pkiPath, issue string) (*SecretClient, error)
  • func (c *SecretClient) FetchSecret(ctx context.Context, name string) (*tls.Secret, time.Time, error)

Constants

const (
	SecretScheme = "vault"
)

Variables

var (
	ErrInvalidSecret = errors.New("invalid vault secret")
)

Types

type LogicalClient

type LogicalClient interface {
	WriteWithContext(context.Context, string, map[string]interface{}) (*api.Secret, error)
}

type Secret

type Secret struct {
	AltNames   string
	CommonName string
	IPSANs     string
	OtherSANs  string
	TTL        string
}

Secret is a wrapper to a certificate secret stored in Vault.

This Vault-specific implementation corresponds with the K8s-specific implementation, utils.K8sSecret.

func NewSecret

func NewSecret(commonName, altNames, ipSANs, otherSANs, ttl string) Secret

NewSecret creates a descriptor for a certificate to be generated via Vault's PKI API. The arguments correspond with inputs to the cert + key generation endpoint. https://www.vaultproject.io/api-docs/secret/pki#generate-certificate-and-key

func ParseSecret

func ParseSecret(ref string) (Secret, error)

ParseSecret accepts an opaque string reference and returns a Secret. The expected format is vault://<common_name>?ttl=<ttl>&ipSans=<sans>... where "common_name", "ttl", etc. correlate with values accepted by Vault's PKI API. Plural vars are generally comma-delimited lists as described in the docs.

https://www.vaultproject.io/api-docs/secret/pki

Some components such as the issuer and issue are configured globally today. In the future, we could include those as additional query parameters.

func (Secret) String

func (s Secret) String() string

String serializes a Secret into an opaque string that can later be parsed and restored to an equivalent Secret.

type SecretClient

type SecretClient struct {
	// contains filtered or unexported fields
}

SecretClient acts as a secret fetcher for Vault.

This Vault-specific implementation corresponds with the K8s-specific implementation, k8s.K8sSecretClient.

func NewSecretClient

func NewSecretClient(logger hclog.Logger, pkiPath, issue string) (*SecretClient, error)

NewSecretClient relies on having standard VAULT_x envars set such as VAULT_TOKEN, VAULT_ADDR, etc. In the future, we may need to construct the config externally to allow for custom flags, etc.

func (*SecretClient) FetchSecret

func (c *SecretClient) FetchSecret(ctx context.Context, name string) (*tls.Secret, time.Time, error)

FetchSecret accepts an opaque string containing necessary values for retrieving a certificate and private key from Vault. It retrieves the certificate and private key, stores them in memory, and returns a tls.Secret acceptable for Envoy SDS.