gcp

Documentation

Index

• type Config
  • func (c *Config) Clone() *Config
• type Conn
  • func Connect(ctx context.Context, c *Config) (*Conn, error)
  • func (c *Conn) Create(ctx context.Context, name string, value []byte) error
  • func (c *Conn) Delete(ctx context.Context, name string) error
  • func (c *Conn) Get(ctx context.Context, name string) ([]byte, error)
  • func (c *Conn) List(ctx context.Context) (kms.Iter, error)
  • func (c *Conn) Status(ctx context.Context) (kms.State, error)
• type Credentials
  • func (c Credentials) MarshalJSON() ([]byte, error)

Types

type Config

type Config struct {
	// Endpoint is the GCP SecretManager endpoint.
	Endpoint string

	// ProjectID is the ID of the GCP project.
	ProjectID string

	// Credentials are the GCP credentials to
	// access the SecretManager.
	Credentials Credentials

	// Scopes are GCP OAuth2 scopes for accessing GCP APIs.
	// If not set, defaults to the GCP default scopes.
	//
	// Ref: https://developers.google.com/identity/protocols/oauth2/scopes
	Scopes []string

	// ErrorLog is an optional logger for errors
	// that may occur when interacting with GCP
	// SecretManager.
	ErrorLog *log.Logger
	// contains filtered or unexported fields
}

Config is a structure containing configuration options for connecting to a KeySecure server.

func (*Config) Clone

func (c *Config) Clone() *Config

Clone returns a shallow clone of c or nil if c is nil. It is safe to clone a Config that is being used concurrently.

type Conn

type Conn struct {
	// contains filtered or unexported fields
}

Conn is a connection to a GCP SecretManager.

func Connect

func Connect(ctx context.Context, c *Config) (*Conn, error)

Connect connects and authenticates to a GCP SecretManager server.

func (*Conn) Create

func (c *Conn) Create(ctx context.Context, name string, value []byte) error

Create stores the given key-value pair at GCP secret manager if and only if it doesn't exists. If such an entry already exists it returns kes.ErrKeyExists.

Creating a secret at the GCP SecretManager requires first creating secret itself and then adding a secret version with some payload data. The payload data contains the actual value.

func (*Conn) Delete

func (c *Conn) Delete(ctx context.Context, name string) error

Delete remove the key-value pair from GCP SecretManager.

Delete will remove all versions of the GCP secret. Even though CreateKey will create only one version and fails if the secret already exists a user may create more secrets versions through e.g. the GCP CLI. However, KES does not support multiple secret versions and expects a different mechanism for "key-rotation".

func (*Conn) Get

func (c *Conn) Get(ctx context.Context, name string) ([]byte, error)

Get returns the value associated with the given key.

func (*Conn) List

func (c *Conn) List(ctx context.Context) (kms.Iter, error)

List returns a new Iterator over the names of all stored keys.

func (*Conn) Status

func (c *Conn) Status(ctx context.Context) (kms.State, error)

Status returns the current state of the GCP SecretManager instance. In particular, whether it is reachable and the network latency.

type Credentials

type Credentials struct {

	// ClientID is the client ID of the GCP service account.
	ClientID string

	// Client is the client email of the GCP service account.
	Client string

	// Key is the private key ID of the GCP service account.
	KeyID string

	// Key is the encoded private key of the GCP service account.
	Key string
	// contains filtered or unexported fields
}

Credentials represent GCP service account credentials.

func (Credentials) MarshalJSON

func (c Credentials) MarshalJSON() ([]byte, error)

MarshalJSON returns a JSON representation of the GCP credentials.

The returned JSON contains extra fields to match the JSON credentials returned by GCP. Those additional fields are set to default values.