vault

Documentation

Index

• Variables
• type AuthClient
  • func (a *AuthClient) Save(path string) error
• type Certificate
  • func (c *Certificate) EnvVars() map[string]string
  • func (c *Certificate) Save(path string) error
• type ClientFactory
  • func NewFileAuthClientFactory(vault *VaultConfig, path string) ClientFactory
  • func NewKubernetesAuthClientFactory(vault *VaultConfig, kube *KubernetesAuthConfig) ClientFactory
• type Credentials
  • func (c *Credentials) EnvVars() map[string]string
  • func (c *Credentials) Save(path string) error
• type CredentialsRenewer
  • func NewManager(client *api.Client, secret Secret, lease time.Duration, renew time.Duration, ...) CredentialsRenewer
• type DefaultManager
  • func (m *DefaultManager) Renew(ctx context.Context) error
  • func (m *DefaultManager) RevokeSelf(ctx context.Context)
  • func (m DefaultManager) Run(ctx context.Context, c chan int)
  • func (m *DefaultManager) Save() error
• type FileSecretsProvider
  • func (c *FileSecretsProvider) Fetch() (Secret, error)
• type FileVaultClientFactory
  • func (f *FileVaultClientFactory) Create() (*AuthClient, error)
• type KubernetesAuthConfig
• type KubernetesVaultClientFactory
  • func (f *KubernetesVaultClientFactory) Create() (*AuthClient, error)
• type Secret
• type SecretType
• type SecretsProvider
  • func NewFileSecretsProvider(secretType SecretType, path string, options map[string]string) SecretsProvider
  • func NewVaultSecretsProvider(client *api.Client, secretType SecretType, secretPath string, ...) SecretsProvider
• type TLSConfig
• type VaultConfig
• type VaultSecretsProvider
  • func (c *VaultSecretsProvider) Fetch() (Secret, error)

Variables

var ErrLeaseNotFound = errors.New("lease not found or is not renewable")

var ErrPermissionDenied = errors.New("permission denied")

Types

type AuthClient

type AuthClient struct {
	Client *api.Client
	// contains filtered or unexported fields
}

func (*AuthClient) Save

func (a *AuthClient) Save(path string) error

type Certificate

type Certificate struct {
	Certificate string
	PrivateKey  string
	Expiration  int64
	Secret      *api.Secret
}

func (*Certificate) EnvVars

func (c *Certificate) EnvVars() map[string]string

func (*Certificate) Save

func (c *Certificate) Save(path string) error

type ClientFactory

type ClientFactory interface {
	Create() (*AuthClient, error)
}

func NewFileAuthClientFactory

func NewFileAuthClientFactory(vault *VaultConfig, path string) ClientFactory

func NewKubernetesAuthClientFactory

func NewKubernetesAuthClientFactory(vault *VaultConfig, kube *KubernetesAuthConfig) ClientFactory

type Credentials

type Credentials struct {
	Username        string
	Password        string
	Secret          *api.Secret
	LeaseExpireTime *string
}

func (*Credentials) EnvVars

func (c *Credentials) EnvVars() map[string]string

func (*Credentials) Save

func (c *Credentials) Save(path string) error

type CredentialsRenewer

type CredentialsRenewer interface {
	Renew(ctx context.Context) error
	RevokeSelf(ctx context.Context)
	Run(ctx context.Context, c chan int)
	Save() error
}

func NewManager

func NewManager(client *api.Client, secret Secret, lease time.Duration, renew time.Duration, provider *VaultSecretsProvider, template *template.Template, gateway *metrics.PushGateway, outPath string) CredentialsRenewer

type DefaultManager

type DefaultManager struct {
	// contains filtered or unexported fields
}

func (*DefaultManager) Renew

func (m *DefaultManager) Renew(ctx context.Context) error

func (*DefaultManager) RevokeSelf

func (m *DefaultManager) RevokeSelf(ctx context.Context)

RevokeSelf this will attempt to revoke its own token

func (DefaultManager) Run

func (m DefaultManager) Run(ctx context.Context, c chan int)

func (*DefaultManager) Save

func (m *DefaultManager) Save() error

type FileSecretsProvider

type FileSecretsProvider struct {
	// contains filtered or unexported fields
}

func (*FileSecretsProvider) Fetch

func (c *FileSecretsProvider) Fetch() (Secret, error)

type FileVaultClientFactory

type FileVaultClientFactory struct {
	// contains filtered or unexported fields
}

func (*FileVaultClientFactory) Create

func (f *FileVaultClientFactory) Create() (*AuthClient, error)

type KubernetesAuthConfig

type KubernetesAuthConfig struct {
	TokenFile string
	LoginPath string
	Role      string
}

type KubernetesVaultClientFactory

type KubernetesVaultClientFactory struct {
	// contains filtered or unexported fields
}

KubernetesVaultClientFactory creates a Vault client authenticated against a kubernetes service account token

func (*KubernetesVaultClientFactory) Create

func (f *KubernetesVaultClientFactory) Create() (*AuthClient, error)

Create returns a Vault client that has been authenticated with the service account token. It can be used to make other Vault requests

type Secret

type Secret interface {
	Save(path string) error
	EnvVars() map[string]string
}

type SecretType

type SecretType string

const (
	CredentialType  SecretType = "credential"
	CertificateType SecretType = "certificate"
)

type SecretsProvider

type SecretsProvider interface {
	Fetch() (Secret, error)
}

func NewFileSecretsProvider

func NewFileSecretsProvider(secretType SecretType, path string, options map[string]string) SecretsProvider

func NewVaultSecretsProvider

func NewVaultSecretsProvider(client *api.Client, secretType SecretType, secretPath string, options map[string]string) SecretsProvider

type TLSConfig

type TLSConfig struct {
	CACert string
	CAPath string
}

type VaultConfig

type VaultConfig struct {
	VaultAddr string
	TLS       *TLSConfig
}

type VaultSecretsProvider

type VaultSecretsProvider struct {
	// contains filtered or unexported fields
}

func (*VaultSecretsProvider) Fetch

func (c *VaultSecretsProvider) Fetch() (Secret, error)