vault

Documentation

Index

• Constants
• type EnvVault
  • func NewDefaultVault() EnvVault
  • func (v EnvVault) DecryptAllEnv(envs []string) ([]string, error)
  • func (v EnvVault) ReadSecretValue(vaultPath string) (string, error)
• type VaultAPI

Constants

const VaultPathPrefix = "vault://"

Types

type EnvVault

type EnvVault struct {
	// contains filtered or unexported fields
}

Client to replace vault paths by the secret valued stored in the Hashicorp Vault

func NewDefaultVault

func NewDefaultVault() EnvVault

NewDefaultVault returns a client using the default configuration.

The default Address is https://127.0.0.1:8200, but this can be overridden by setting the `VAULT_ADDR` environment variable.

func (EnvVault) DecryptAllEnv

func (v EnvVault) DecryptAllEnv(envs []string) ([]string, error)

DecryptAllEnv decrypts all envs that contains a Vault path. All values staring with `vault://` are overridden by the secret valued stored in the path. For instances:

Input: ["db_url=url","db_pass=vault://secret/db_pass"]

Output: ["db_url=url","db_pass=ACTUAL_SECRET_PASS"]

func (EnvVault) ReadSecretValue

func (v EnvVault) ReadSecretValue(vaultPath string) (string, error)

ReadSecretValue returns the secret value of a Vault path.

type VaultAPI

type VaultAPI interface {
	Address() string
	NewRequest(method, path string) *api.Request
	RawRequest(r *api.Request) (*api.Response, error)
}

Our own narrowly-scoped interface for Hashicorp Vault Client