disable

Documentation

Overview

Package disable provides the business logic for managing the disablement of old secrets that have been rotated. In a typical secret rotation use-case, at least two active secrets are maintained at the point of rotation to avoid causing an outage for any running process using the current secret. Then, a followup process will disable/delete the old secret after the new secret has been established. This pakcage manages the disablement process.

Index

• type Client
• type Manager
  • func New(rc Client, disableAfter time.Duration, dryRun bool, secrets []config.Secret) *Manager
  • func (m *Manager) DisableSecrets(ctx context.Context) error

Types

type Client

type Client interface {
	// Name should return a string that clearly identifies the plugin to the
	// administrator and is attached to log and error messages.
	Name() string

	// LastUpdated must return the timestamp when the newest inactive secret was
	// last updated. Usually this will be the creation data of an access token
	// or other piece of data.
	//
	// The context provides a logger via the
	// github.com/zostay/garotate/pkg/config package. It may also be
	// used for timeouts.
	//
	// The secret.Info describes the secret that is being checked for
	// disablement.
	LastUpdated(context.Context, secret.Info) (time.Time, error)

	// DisableSecret must perform disablement of all inactive secrets associated
	// with the account.
	//
	// The context provides a logger via the
	// github.com/zostay/garotate/pkg/config package. It may also be
	// used for timeouts.
	//
	// The secret.Info describes the secret that is being checked for
	// disablement.
	DisableSecret(context.Context, secret.Info) error
}

Client defines the interface that any plugin that wishes to perform disablement must implement. It provides means for identifying the client, detecting when a configured secret is ready for disablement, and the method for performing disablement.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager provides the business logic for detecting whether a secret is old enough to require disablement or not and disable those secrets.

func New

func New(
	rc Client,
	disableAfter time.Duration,
	dryRun bool,
	secrets []config.Secret,
) *Manager

New constructs a new object to perform password disablement.

func (*Manager) DisableSecrets

func (m *Manager) DisableSecrets(ctx context.Context) error

DisableSecrets examines all the IAM keys and disables any of the non-active keys that have surpassed the maxActiveAge.