vault

Documentation

Index

• Constants
• Variables
• type KVClient
• type KVSecret
  • func NewKVSecret(path, certField, privateKeyField string) KVSecret
  • func ParseKVSecret(ref string) (KVSecret, error)
  • func (s KVSecret) String() string
• type KVSecretClient
  • func NewKVSecretClient(logger hclog.Logger, kvPath string) (*KVSecretClient, error)
  • func (c *KVSecretClient) FetchSecret(ctx context.Context, name string) (*tls.Secret, time.Time, error)
• type LogicalClient
• type PKISecret
  • func NewPKISecret(commonName, altNames, ipSANs, otherSANs, ttl string) PKISecret
  • func ParsePKISecret(ref string) (PKISecret, error)
  • func (s PKISecret) String() string
• type PKISecretClient
  • func NewPKISecretClient(logger hclog.Logger, pkiPath, issue string) (*PKISecretClient, error)
  • func (c *PKISecretClient) FetchSecret(ctx context.Context, name string) (*tls.Secret, time.Time, error)

Constants

const (
	KVSecretScheme  = "vault+kv"
	PKISecretScheme = "vault+pki"
)

Variables

var (
	ErrInvalidSecret = errors.New("invalid vault secret")
)

Types

type KVClient

type KVClient interface {
	Get(context.Context, string) (*api.KVSecret, error)
}

type KVSecret

type KVSecret struct {
	Path            string
	CertField       string
	PrivateKeyField string
}

func NewKVSecret

func NewKVSecret(path, certField, privateKeyField string) KVSecret

func ParseKVSecret

func ParseKVSecret(ref string) (KVSecret, error)

func (KVSecret) String

func (s KVSecret) String() string

type KVSecretClient

type KVSecretClient struct {
	// contains filtered or unexported fields
}

KVSecretClient acts as a certificate retriever using Vault's KV store.

This Vault-specific implementation corresponds with the K8s-specific implementation, k8s.K8sSecretClient.

func NewKVSecretClient

func NewKVSecretClient(logger hclog.Logger, kvPath string) (*KVSecretClient, error)

NewKVSecretClient relies on having standard VAULT_x envars set such as VAULT_TOKEN, VAULT_ADDR, etc. In the future, we may need to construct the config externally to allow for custom flags, etc.

func (*KVSecretClient) FetchSecret

func (c *KVSecretClient) FetchSecret(ctx context.Context, name string) (*tls.Secret, time.Time, error)

FetchSecret accepts an opaque string containing necessary values for retrieving a certificate and private key from Vault KV. It retrieves the certificate and private key, stores them in memory, and returns a tls.Secret acceptable for Envoy SDS.

type LogicalClient

type LogicalClient interface {
	WriteWithContext(context.Context, string, map[string]interface{}) (*api.Secret, error)
}

type PKISecret

type PKISecret struct {
	AltNames   string
	CommonName string
	IPSANs     string
	OtherSANs  string
	TTL        string
}

PKISecret is a wrapper to a certificate secret to be generated by Vault.

This Vault-specific implementation corresponds with the K8s-specific implementation, utils.K8sSecret.

func NewPKISecret

func NewPKISecret(commonName, altNames, ipSANs, otherSANs, ttl string) PKISecret

NewPKISecret creates a descriptor for a certificate to be generated via Vault's PKI API. The arguments correspond with inputs to the cert + key generation endpoint. https://www.vaultproject.io/api-docs/secret/pki#generate-certificate-and-key

func ParsePKISecret

func ParsePKISecret(ref string) (PKISecret, error)

ParsePKISecret accepts an opaque string reference and returns a PKISecret. The expected format is vault://<common_name>?ttl=<ttl>&ipSans=<sans>... where "common_name", "ttl", etc. correlate with values accepted by Vault's PKI API. Plural vars are generally comma-delimited lists as described in the docs.

https://www.vaultproject.io/api-docs/secret/pki

Some components such as the issuer and issue are configured globally today. In the future, we could include those as additional query parameters.

func (PKISecret) String

func (s PKISecret) String() string

String serializes a PKISecret into an opaque string that can later be parsed and restored to an equivalent PKISecret.

type PKISecretClient

type PKISecretClient struct {
	// contains filtered or unexported fields
}

PKISecretClient acts as a certificate generator using Vault's PKI engine.

This Vault-specific implementation corresponds with the K8s-specific implementation, k8s.K8sSecretClient.

func NewPKISecretClient

func NewPKISecretClient(logger hclog.Logger, pkiPath, issue string) (*PKISecretClient, error)

NewPKISecretClient relies on having standard VAULT_x envars set such as VAULT_TOKEN, VAULT_ADDR, etc. In the future, we may need to construct the config externally to allow for custom flags, etc.

func (*PKISecretClient) FetchSecret

func (c *PKISecretClient) FetchSecret(ctx context.Context, name string) (*tls.Secret, time.Time, error)

FetchSecret accepts an opaque string containing necessary values for generating a certificate and private key with Vault's PKI engine. It generates the certificate and private key, stores them in memory, and returns a tls.Secret acceptable for Envoy SDS.