secret

Documentation

Overview

Package secret is beekeeper secret: the credential operations beekeeper runs in its own process so that no agent reads a value. sops and op run here, the values they answer stay in memory for the one operation, and what an operation returns is key names, lengths, equality and keyed fingerprints, never a value. Nothing is written in plaintext: a SOPS file is written encrypted, from sops' own output.

Index

• Constants
• func Charsets() []string
• func Consumer(argv []string) error
• func Exec(ctx context.Context, dir string, env []string, stdin io.Reader, name string, ...) ([]byte, error)
• func Generate(n int, charset string) (string, error)
• type Carrier
• type Key
• type Ops
  • func (o *Ops) Compare(ctx context.Context, a, b Ref) ([]Verdict, error)
  • func (o *Ops) CopyFile(ctx context.Context, src Ref, dst, name, namespace string) ([]Key, error)
  • func (o *Ops) CopyToConsumer(ctx context.Context, src Ref, argv []string) (int, string, error)
  • func (o *Ops) CopyValue(ctx context.Context, src, dst Ref) (int, error)
  • func (o *Ops) Fingerprints(ctx context.Context, r Ref) ([]Print, error)
  • func (o *Ops) RotateGenerated(ctx context.Context, ref Ref, files []string, ix *guard.Index, length int, ...) (Rotation, error)
  • func (o *Ops) RotateIssued(ctx context.Context, ref Ref, files []string, ix *guard.Index) (Rotation, error)
  • func (o *Ops) RotatePlatform(ctx context.Context, r PlatformRef, reason string, dryRun bool) (string, error)
  • func (o *Ops) Set(ctx context.Context, dst, vault Ref, length int, charset string) (string, error)
• type PlatformRef
  • func ParsePlatformRef(s string) (PlatformRef, error)
  • func (r PlatformRef) String() string
• type Print
• type Ref
  • func ParseRef(s string) (Ref, error)
  • func (r Ref) String() string
• type Rotation
• type Runner
• type Verdict

Constants

const (
	Equal     = "equal"
	Different = "different"
	OnlyA     = "only in a"
	OnlyB     = "only in b"
)

The states compare answers per key.

const PlatformPrefix = "platform://"

PlatformPrefix opens a PlatformRef.

Functions

func Charsets

func Charsets() []string

Charsets names the character sets, sorted.

func Consumer

func Consumer(argv []string) error

Consumer allows a command to take a value on stdin: one that reads a secret from stdin and stores it without printing it.

func Exec

func Exec(ctx context.Context, dir string, env []string, stdin io.Reader, name string, args ...string) ([]byte, error)

Exec is the Runner of the real tools.

func Generate

func Generate(n int, charset string) (string, error)

Generate draws a value of n characters from a named set.

Types

type Carrier

type Carrier struct {
	Ref    string `json:"ref"`
	Base64 bool   `json:"base64,omitempty"`
}

Carrier is a SOPS path that carried a rotated value: the value itself, or its base64 form (a Kubernetes Secret's data).

type Key

type Key struct {
	Name  string `json:"name"`
	Bytes int    `json:"bytes"`
}

Key is a key name and the length of its value, all an answer tells.

type Ops

type Ops struct {
	Run Runner
	// Vault is the shared 1Password vault, the only one an op:// reference
	// may name; empty refuses every op:// reference.
	Vault string
	// Token is the vault's service account token, which only op's own
	// environment gets; empty refuses every op:// reference.
	Token string
	// Fingerprint is the keyed hash fingerprint answers with.
	Fingerprint func(value string) string
}

Ops are the operations over one configuration.

func (*Ops) Compare

func (o *Ops) Compare(ctx context.Context, a, b Ref) ([]Verdict, error)

Compare answers per key whether a and b hold the same values. Two single references compare as one value; two whole files key by key.

func (*Ops) CopyFile

func (o *Ops) CopyFile(ctx context.Context, src Ref, dst, name, namespace string) ([]Key, error)

CopyFile copies a whole SOPS file to a new one, encrypted under the destination's creation rules, with a Kubernetes object's metadata.name and metadata.namespace rewritten when given. It answers the keys and their lengths.

func (*Ops) CopyToConsumer

func (o *Ops) CopyToConsumer(ctx context.Context, src Ref, argv []string) (int, string, error)

CopyToConsumer runs an allowed consumer with the value on stdin. It answers the consumer's exit code and its output with the value redacted.

func (*Ops) CopyValue

func (o *Ops) CopyValue(ctx context.Context, src, dst Ref) (int, error)

CopyValue copies one value into a path of a SOPS file, creating the file or the key when absent. It answers the value's length.

func (*Ops) Fingerprints

func (o *Ops) Fingerprints(ctx context.Context, r Ref) ([]Print, error)

Fingerprints are the keyed fingerprints of what r names.

func (*Ops) RotateGenerated

func (o *Ops) RotateGenerated(ctx context.Context, ref Ref, files []string, ix *guard.Index, length int, charset string) (Rotation, error)

RotateGenerated replaces a value beekeeper generated: a new one into the shared vault's field first, then into every path of files that carried the old one, matched by fingerprint. Index matches and learns the values.

func (*Ops) RotateIssued

func (o *Ops) RotateIssued(ctx context.Context, ref Ref, files []string, ix *guard.Index) (Rotation, error)

RotateIssued carries a value a third party issued, which the person put into the shared vault's field, into every path of files that carried the field's old value: the one the index fingerprinted.

func (*Ops) RotatePlatform

func (o *Ops) RotatePlatform(ctx context.Context, r PlatformRef, reason string, dryRun bool) (string, error)

RotatePlatform rotates a platform manager credential with the manager's own rotation, run on the host: platformctl reconciles the capability with --rotate, the manager writes the new value into the installation's SOPS files in a pull request, and nothing is decrypted here. dryRun shows the files that hold it instead. It answers platformctl's output, redacted.

func (*Ops) Set

func (o *Ops) Set(ctx context.Context, dst, vault Ref, length int, charset string) (string, error)

Set generates a value, writes it to the shared vault's field first and then into the SOPS path, and answers its fingerprint.

type PlatformRef

type PlatformRef struct {
	Installation, Capability, Name string
}

PlatformRef is a credential the platform manager generates: platform://<installation>/<capability>/<name>, the name as the manager's dry run lists its generated secrets.

func ParsePlatformRef

func ParsePlatformRef(s string) (PlatformRef, error)

ParsePlatformRef reads a platform:// reference.

func (PlatformRef) String

func (r PlatformRef) String() string

type Print

type Print struct {
	Key         string `json:"key"`
	Fingerprint string `json:"fingerprint"`
}

Print is a value's keyed fingerprint.

type Ref

type Ref struct {
	Op   string
	File string
	Path string
}

Ref names a value or a set of values: an op:// field of the shared vault, a SOPS file, or one path in a SOPS file (file#a.b.c, sops:// in front optional).

func ParseRef

func ParseRef(s string) (Ref, error)

ParseRef reads a reference.

func (Ref) String

func (r Ref) String() string

String is the reference as a log and an answer name it.

type Rotation

type Rotation struct {
	Ref         string    `json:"ref"`
	Fingerprint string    `json:"fingerprint"`
	Carriers    []Carrier `json:"carriers"`
}

Rotation is what rotate answers: the rotated reference, the new value's fingerprint and the SOPS paths that carry it now.

type Runner

type Runner func(ctx context.Context, dir string, env []string, stdin io.Reader, name string, args ...string) ([]byte, error)

Runner runs a credential tool in dir with stdin, its environment plus env, and returns its stdout. Its error must carry nothing the tool printed but a redacted first line.

type Verdict

type Verdict struct {
	Key   string `json:"key"`
	State string `json:"state"`
}

Verdict is compare's answer for one key.