secretmanager

Documentation

Overview

Package secretmanager loads configuration from GCP Secret Manager.

It requires following roles on the target project:

• roles/secretmanager.viewer

Change notification

By default, it periodically polls the configuration only. It also listens to change events by register it to PubSub notifier with Set up notifications on a secret.

Only following events trigger polling the configuration and other type of events are ignored:

• SECRET_VERSION_ADD
• SECRET_VERSION_ENABLE
• SECRET_VERSION_DISABLE
• SECRET_VERSION_DESTROY

Index

• type Option
  • func WithFilter(filter string) Option
  • func WithNameSplitter(splitter func(string) []string) Option
  • func WithPollInterval(interval time.Duration) Option
  • func WithProject(project string) Option
• type SecretManager
  • func New(opts ...Option) *SecretManager
  • func (m *SecretManager) Load() (map[string]any, error)
  • func (m *SecretManager) OnEvent(attributes map[string]string) error
  • func (m *SecretManager) Status(onStatus func(bool, error))
  • func (m *SecretManager) String() string
  • func (m *SecretManager) Watch(ctx context.Context, onChange func(map[string]any)) error

Types

type Option

type Option = option.ClientOption

func WithFilter

func WithFilter(filter string) Option

WithFilter provides [filter] that will be used to select a set of secrets.

[filter]: // https://cloud.google.com/secret-manager/docs/filtering

func WithNameSplitter

func WithNameSplitter(splitter func(string) []string) Option

WithNameSplitter provides the function used to split secret names into nested keys. If it returns an nil/[]string{}/[]string{""}, the secret will be ignored.

For example, with the default splitter, an secret name like "PARENT-CHILD-KEY" would be split into "PARENT", "CHILD", and "KEY".

func WithPollInterval

func WithPollInterval(interval time.Duration) Option

WithPollInterval provides the interval for polling the configuration.

The default interval is 1 minute.

func WithProject

func WithProject(project string) Option

WithProject provides GCP project ID.

By default, it fetches project ID from metadata server.

type SecretManager

type SecretManager struct {
	// contains filtered or unexported fields
}

SecretManager is a Provider that loads configuration from GCP Secret Manager.

To create a new SecretManager, call New.

func New

func New(opts ...Option) *SecretManager

New creates a SecretManager with the given endpoint and Option(s).

func (*SecretManager) Load

func (m *SecretManager) Load() (map[string]any, error)

func (*SecretManager) OnEvent

func (m *SecretManager) OnEvent(attributes map[string]string) error

func (*SecretManager) Status

func (m *SecretManager) Status(onStatus func(bool, error))

func (*SecretManager) String

func (m *SecretManager) String() string

func (*SecretManager) Watch

func (m *SecretManager) Watch(ctx context.Context, onChange func(map[string]any)) error