secret

README

Secret service

Secret service provide convenient way of handling credentials.

Generic Credentials retrieval

Service supports the following form of * to retrieve credentials:

1. URL i.e. mem://secret/localhost.json, secretmanager://.....,
2. Relative path i.e. localhost.json, in this case based directory will be used to lookup credential resource
3. Short name i.e. localhost, in this case based directory will be used to lookup credential resource and .json ext will be added.

Base directory can be file or URL, if empty '$HOME/.secret/' is used

    service := secret.New() 
    var secret = secret.Resource("localhost")
	secret, err := service.Lookup(secret)
	if err !=nil {
		panic(err)
    }
    cred, ok := secret.Target.(*cred.Generic)
	if ! ok  {
	    panic("invalid secret type")
	}

Secrets are defined as type Secrets map[secret.Key]secret.Resource

Secret expansion

Very common case for the application it to take encrypted credential to used wither username or password. For example while running terminal command we may need to provide super user password and sometimes other secret, in one command that we do not want to reveal to final user.

Take the following code as example:

        

    service := New()
    secrets := NewSecrets()
    {//password expansion
        secrets["mysql"] = "~/.secret/mysql.json"
        input := "docker run --name db1 -e MYSQL_ROOT_PASSWORD=${mysql.password} -d mysql:tag"
   	    expaned, err := service.Expand(input, secrets)
   	}

   	{//username and password expansion
        secrets["pg"] = "~/.secret/pg.json"
        input := "docker run --name some-postgres -e POSTGRES_PASSWORD=${pg.password} -e POSTGRES_USER=${pg.username} -d postgres"
        expaned, err := service.Expand(input, secrets)
    }
  

Documentation

Index

• type Key
  • func (s Key) String() string
• type Option
  • func WithBaseDirectory(baseDirectory string) Option
  • func WithFileSystem(fs *embed.FS) Option
• type Resource
  • func (r Resource) Key() string
  • func (r Resource) String() string
  • func (r Resource) URL() string
• type Secrets
  • func NewSecrets(secrets map[string]string) Secrets
• type Service
  • func New(opts ...Option) *Service
  • func (s *Service) Expand(ctx context.Context, input string, secrets map[Key]Resource) (string, error)
  • func (s *Service) ExpandSecret(ctx context.Context, input string, key Key, resource Resource) (string, error)
  • func (s *Service) GetCredentials(ctx context.Context, resource string) (*cred.Generic, error)
  • func (s *Service) GeyKey(ctx context.Context, resource string) (*cred.SecretKey, error)
  • func (s *Service) Lookup(ctx context.Context, secret Resource) (*scy.Secret, error)

Types

type Key

type Key string

Key represent secret key

func (Key) String

func (s Key) String() string

String returns secret key as string

type Option

type Option func(s *Service)

Option represents a service option

func WithBaseDirectory

func WithBaseDirectory(baseDirectory string) Option

WithBaseDirectory sets base directory

func WithFileSystem

func WithFileSystem(fs *embed.FS) Option

WithFileSystem sets file system

type Resource

type Resource string

Resource represents a secret

func (Resource) Key

func (r Resource) Key() string

func (Resource) String

func (r Resource) String() string

func (Resource) URL

func (r Resource) URL() string

type Secrets

type Secrets map[Key]Resource

Secrets represents Secret to Location map

func NewSecrets

func NewSecrets(secrets map[string]string) Secrets

NewSecrets creates new secrets

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service represents a secret service

func New

func New(opts ...Option) *Service

New creates a new secret service

func (*Service) Expand

func (s *Service) Expand(ctx context.Context, input string, secrets map[Key]Resource) (string, error)

Expand expands input credential keys with actual CredentialsFromLocation

func (*Service) ExpandSecret

func (s *Service) ExpandSecret(ctx context.Context, input string, key Key, resource Resource) (string, error)

func (*Service) GetCredentials

func (s *Service) GetCredentials(ctx context.Context, resource string) (*cred.Generic, error)

GetCredentials returns credentials for supplied resource

func (*Service) GeyKey

func (s *Service) GeyKey(ctx context.Context, resource string) (*cred.SecretKey, error)

GeyKey returns secret key for supplied resource

func (*Service) Lookup

func (s *Service) Lookup(ctx context.Context, secret Resource) (*scy.Secret, error)