vault

Documentation

Overview

package: vault / secrets type: interface + factory job: the Vault port — a secret reference in, its value out — plus its factory limits: contract + dispatch; secret fetching lives in the backends (-> adapters/vault/openbao, azure)

Package vault defines the secret-resolution port and builds the configured backend. The config loader calls Secret to expand vault(ref) placeholders. It is optional: a stack whose every adapter needs no secret (mem/fs storage, in-memory signer, no auth) configures no vault at all. The vault is built env-only — secret-zero cannot resolve vault() before the vault exists.

Index

• type Vault
  • func New(ctx context.Context, cfg scope.Section) (Vault, error)

Types

type Vault

type Vault interface {
	// Secret returns the value stored under ref, or an error if it is absent
	// or the vault is unreachable.
	Secret(ctx context.Context, ref string) (string, error)
}

Vault resolves secret references to their plaintext values. Backends: OpenBao KV and Azure Key Vault (-> sub-packages).

func New

func New(ctx context.Context, cfg scope.Section) (Vault, error)

New builds the vault backend named by the section's "type": "openbao" (KV v2) or "azure" (Azure Key Vault, scaffold). An empty or unknown type is an error.