vault

Documentation

Index

• type Client
  • func New(addr string, token string, probe bool, httpClient *http.Client) (*Client, error)
  • func (c *Client) Key(ctx context.Context, namespace, key string) (*signer.VaultKey, error)
  • func (c *Client) Keys(ctx context.Context, namespace string) ([]*signer.VaultKey, error)
  • func (c *Client) NamespaceKeys(ctx context.Context, namespace string) ([]string, error)
  • func (c *Client) Namespaces(ctx context.Context) ([]string, error)
  • func (c *Client) Sign(data []byte) ([]byte, error)
  • func (c *Client) WithKey(namespace, key string) signer.Vault

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

func New

func New(addr string, token string, probe bool, httpClient *http.Client) (*Client, error)

New creates a Hashicorp Vault client.

func (*Client) Key

func (c *Client) Key(ctx context.Context, namespace, key string) (*signer.VaultKey, error)

Key fetches a key with the given namespace and name from the Vault.

Key namespace correspond 1:1 with a Vault transit engine path.

func (*Client) Keys

func (c *Client) Keys(ctx context.Context, namespace string) ([]*signer.VaultKey, error)

Keys fetches all keys from a given namespace. As the Vault doesn't support retrieving all keys at once, the function first takes all key names, and then fetches key information for every returned key name.

Keys namespace correspond 1:1 with a Vault transit engine path.

func (*Client) NamespaceKeys

func (c *Client) NamespaceKeys(ctx context.Context, namespace string) ([]string, error)

NamespaceKeys returns the names of the keys in a given namespace (vault transit engine).

func (*Client) Namespaces

func (c *Client) Namespaces(ctx context.Context) ([]string, error)

Namespaces returns the names of available transit engines in the Vault.

Note: only Vault transit engine names are returned.

func (*Client) Sign

func (c *Client) Sign(data []byte) ([]byte, error)

Sign calls the Vault transit API to produce a signature on the given data. The key that will be used for signing is determined by the signkey attribute of the Client. If you want to sign with a different key, you should call client.WithKey before making the Sign. For example:

client := vault.WithKey("transit", "key1") client.Sign(...)

func (*Client) WithKey

func (c *Client) WithKey(namespace, key string) signer.Vault

WithKey must be called before calling Sign on the client, as each request might be used with a different signing key. This function will make a new Client wrapper with just the key being different.