vault

Documentation

Index

• Variables
• type AuthClient
  • func (a *AuthClient) Save(path string) error
• type ClientFactory
  • func NewFileAuthClientFactory(vault *VaultConfig, path string) ClientFactory
  • func NewKubernetesAuthClientFactory(vault *VaultConfig, kube *KubernetesAuthConfig) ClientFactory
• type Credentials
  • func (c *Credentials) Save(path string) error
• type CredentialsProvider
  • func NewFileCredentialsProvider(path string) CredentialsProvider
  • func NewVaultCredentialsProvider(client *api.Client, secretPath string) CredentialsProvider
• type CredentialsRenewer
  • func NewLeaseManager(client *api.Client, secret *api.Secret, lease time.Duration, ...) CredentialsRenewer
• type DefaultLeaseManager
  • func (m *DefaultLeaseManager) Renew(ctx context.Context) error
  • func (m *DefaultLeaseManager) RevokeSelf(ctx context.Context)
  • func (m DefaultLeaseManager) Run(ctx context.Context, c chan int)
• type FileCredentialsProvider
  • func (c *FileCredentialsProvider) Fetch() (*Credentials, error)
• type FileVaultClientFactory
  • func (f *FileVaultClientFactory) Create() (*AuthClient, error)
• type KubernetesAuthConfig
• type KubernetesVaultClientFactory
  • func (f *KubernetesVaultClientFactory) Create() (*AuthClient, error)
• type TLSConfig
• type VaultConfig
• type VaultCredentialsProvider
  • func (c *VaultCredentialsProvider) Fetch() (*Credentials, error)

Variables

var ErrLeaseNotFound = errors.New("lease not found or is not renewable")

var ErrPermissionDenied = errors.New("permission denied")

Types

type AuthClient

type AuthClient struct {
	Client *api.Client
	// contains filtered or unexported fields
}

func (*AuthClient) Save

func (a *AuthClient) Save(path string) error

type ClientFactory

type ClientFactory interface {
	Create() (*AuthClient, error)
}

func NewFileAuthClientFactory

func NewFileAuthClientFactory(vault *VaultConfig, path string) ClientFactory

func NewKubernetesAuthClientFactory

func NewKubernetesAuthClientFactory(vault *VaultConfig, kube *KubernetesAuthConfig) ClientFactory

type Credentials

type Credentials struct {
	Username string
	Password string
	Secret   *api.Secret
}

func (*Credentials) Save

func (c *Credentials) Save(path string) error

type CredentialsProvider

type CredentialsProvider interface {
	Fetch() (*Credentials, error)
}

func NewFileCredentialsProvider

func NewFileCredentialsProvider(path string) CredentialsProvider

func NewVaultCredentialsProvider

func NewVaultCredentialsProvider(client *api.Client, secretPath string) CredentialsProvider

type CredentialsRenewer

type CredentialsRenewer interface {
	Renew(ctx context.Context) error
	RevokeSelf(ctx context.Context)
	Run(ctx context.Context, c chan int)
}

func NewLeaseManager

func NewLeaseManager(client *api.Client, secret *api.Secret, lease time.Duration, renew time.Duration) CredentialsRenewer

type DefaultLeaseManager

type DefaultLeaseManager struct {
	// contains filtered or unexported fields
}

func (*DefaultLeaseManager) Renew

func (m *DefaultLeaseManager) Renew(ctx context.Context) error

func (*DefaultLeaseManager) RevokeSelf

func (m *DefaultLeaseManager) RevokeSelf(ctx context.Context)

RevokeSelf this will attempt to revoke its own token

func (DefaultLeaseManager) Run

func (m DefaultLeaseManager) Run(ctx context.Context, c chan int)

type FileCredentialsProvider

type FileCredentialsProvider struct {
	// contains filtered or unexported fields
}

func (*FileCredentialsProvider) Fetch

func (c *FileCredentialsProvider) Fetch() (*Credentials, error)

type FileVaultClientFactory

type FileVaultClientFactory struct {
	// contains filtered or unexported fields
}

func (*FileVaultClientFactory) Create

func (f *FileVaultClientFactory) Create() (*AuthClient, error)

type KubernetesAuthConfig

type KubernetesAuthConfig struct {
	TokenFile string
	LoginPath string
	Role      string
}

type KubernetesVaultClientFactory

type KubernetesVaultClientFactory struct {
	// contains filtered or unexported fields
}

KubernetesVaultClientFactory creates a Vault client authenticated against a kubernetes service account token

func (*KubernetesVaultClientFactory) Create

func (f *KubernetesVaultClientFactory) Create() (*AuthClient, error)

Create returns a Vault client that has been authenticated with the service account token. It can be used to make other Vault requests

type TLSConfig

type TLSConfig struct {
	CACert string
	CAPath string
}

type VaultConfig

type VaultConfig struct {
	VaultAddr string
	TLS       *TLSConfig
}

type VaultCredentialsProvider

type VaultCredentialsProvider struct {
	// contains filtered or unexported fields
}

func (*VaultCredentialsProvider) Fetch

func (c *VaultCredentialsProvider) Fetch() (*Credentials, error)