vault

Documentation

Overview

Package vault provides the ability for Vela to integrate with HashiCorp Vault as a secret backend.

Usage:

import "github.com/go-vela/server/secret/vault"

Index

• Constants
• type Client
  • func New(opts ...ClientOpt) (*Client, error)
  • func NewWithContext(ctx context.Context, opts ...ClientOpt) (*Client, error)
  • func (c *Client) Count(_ context.Context, sType, org, name string, _ []string) (i int64, err error)
  • func (c *Client) Create(_ context.Context, sType, org, name string, s *api.Secret) (*api.Secret, error)
  • func (c *Client) Delete(_ context.Context, sType, org, name, path string) error
  • func (c *Client) Driver() string
  • func (c *Client) Get(_ context.Context, sType, org, name, path string) (s *velaAPI.Secret, err error)
  • func (c *Client) List(ctx context.Context, sType, org, name string, _, _ int, _ []string) ([]*velaAPI.Secret, error)
  • func (c *Client) Update(ctx context.Context, sType, org, name string, s *api.Secret) (*api.Secret, error)
• type ClientOpt
  • func WithAWSRole(awsRole string) ClientOpt
  • func WithAddress(address string) ClientOpt
  • func WithAuthMethod(authMethod string) ClientOpt
  • func WithPrefix(prefix string) ClientOpt
  • func WithToken(token string) ClientOpt
  • func WithTokenDuration(tokenDuration time.Duration) ClientOpt
  • func WithVersion(version string) ClientOpt
• type STSPresigner

Constants

const (
	PrefixVaultV1 = "secret"
	PrefixVaultV2 = "secret/data"
)

Types

type Client

type Client struct {
	AWS   *awsCfg
	Vault *api.Client
	// https://pkg.go.dev/github.com/sirupsen/logrus#Entry
	Logger *logrus.Entry
	// contains filtered or unexported fields
}

func New

func New(opts ...ClientOpt) (*Client, error)

New returns a Secret implementation that integrates with a Vault secrets engine.

func NewWithContext

func NewWithContext(ctx context.Context, opts ...ClientOpt) (*Client, error)

NewWithContext matches New but allows callers to provide a context.

func (*Client) Count

func (c *Client) Count(_ context.Context, sType, org, name string, _ []string) (i int64, err error)

Count counts a list of secrets.

func (*Client) Create

func (c *Client) Create(_ context.Context, sType, org, name string, s *api.Secret) (*api.Secret, error)

Create creates a new secret.

func (*Client) Delete

func (c *Client) Delete(_ context.Context, sType, org, name, path string) error

Delete deletes a secret.

func (*Client) Driver

func (c *Client) Driver() string

Driver outputs the configured secret driver.

func (*Client) Get

func (c *Client) Get(_ context.Context, sType, org, name, path string) (s *velaAPI.Secret, err error)

Get captures a secret.

func (*Client) List

func (c *Client) List(ctx context.Context, sType, org, name string, _, _ int, _ []string) ([]*velaAPI.Secret, error)

List captures a list of secrets. TODO: Implement fake pagination? We drop page and perPage as we are always returning all results. Vault API doesn't seem to support pagination. Might result in undesired behavior for fetching Vault secrets in paginated manner.

func (*Client) Update

func (c *Client) Update(ctx context.Context, sType, org, name string, s *api.Secret) (*api.Secret, error)

Update updates a secret.

type ClientOpt

type ClientOpt func(*Client) error

ClientOpt represents a configuration option to initialize the secret client for Vault.

func WithAWSRole

func WithAWSRole(awsRole string) ClientOpt

WithAWSRole sets the AWS role in the secret client for Vault.

func WithAddress

func WithAddress(address string) ClientOpt

WithAddress sets the address in the secret client for Vault.

func WithAuthMethod

func WithAuthMethod(authMethod string) ClientOpt

WithAuthMethod sets the authentication method in the secret client for Vault.

func WithPrefix

func WithPrefix(prefix string) ClientOpt

WithPrefix sets the prefix in the secret client for Vault.

func WithToken

func WithToken(token string) ClientOpt

WithToken sets the token in the secret client for Vault.

func WithTokenDuration

func WithTokenDuration(tokenDuration time.Duration) ClientOpt

WithTokenDuration sets the token duration in the secret client for Vault.

func WithVersion

func WithVersion(version string) ClientOpt

WithVersion sets the version in the secret client for Vault.

type STSPresigner

type STSPresigner interface {
	PresignGetCallerIdentity(ctx context.Context, params *sts.GetCallerIdentityInput, optFns ...func(*sts.PresignOptions)) (*sigV4.PresignedHTTPRequest, error)
}

STSPresigner captures the subset of the STS presign client we rely on so the AWS SDK v2 dependency can be mocked in tests; v2 removed the old stsiface shim.