Documentation

Overview

    Package secrets defines a minimum abstract interface for a secret manager. Allows for a different implementation to be bound within the ServeEnv.

    Although exported, this package is non intended for general consumption. It is a shared dependency between multiple exposure notifications projects. We cannot guarantee that there won't be breaking changes in the future.

    Index

    Constants

    View Source
    const (
    	// SecretPrefix is the prefix, that if the value of an env var starts with
    	// will be resolved through the configured secret store.
    	SecretPrefix = "secret://"
    
    	// FileSuffix is the suffix to use, if this secret path should be written to a file.
    	// only interpreted on environment variable values that start w/ secret://
    	FileSuffix = "?target=file"
    )

    Variables

    This section is empty.

    Functions

    func RegisterManager

    func RegisterManager(name string, fn SecretManagerFunc)

      RegisterManager registers a new secret manager with the given name. If a manager is already registered with the given name, it panics. Managers are usually registered via an init function.

      func RegisteredManagers

      func RegisteredManagers() []string

        RegisteredManagers returns the list of the names of the registered secret managers.

        func Resolver

        func Resolver(sm SecretManager, config *Config) envconfig.MutatorFunc

          Resolver returns a function that fetches secrets from the secret manager. If the provided secret manager is nil, the function is nil, Otherwise, it looks for values prefixed with secret:// and resolves them as secrets. For slice functions, values separated by commas are processed as individual secrets.

          Types

          type Cacher

          type Cacher struct {
          	// contains filtered or unexported fields
          }

            Cacher is a secret manager implementation that wraps another secret manager and caches secret values.

            func (*Cacher) GetSecretValue

            func (sm *Cacher) GetSecretValue(ctx context.Context, name string) (string, error)

              GetSecretValue implements the SecretManager interface, but caches values and retrieves them from the cache.

              type Config

              type Config struct {
              	Type            string        `env:"SECRET_MANAGER, default=IN_MEMORY"`
              	SecretsDir      string        `env:"SECRETS_DIR, default=/var/run/secrets"`
              	SecretCacheTTL  time.Duration `env:"SECRET_CACHE_TTL, default=5m"`
              	SecretExpansion bool          `env:"SECRET_EXPANSION, default=false"`
              }

                Config represents the config for a secret manager.

                type InMemory

                type InMemory struct {
                	// contains filtered or unexported fields
                }

                  InMemory is an in-memory secret manager, primarily used for testing.

                  func (*InMemory) GetSecretValue

                  func (m *InMemory) GetSecretValue(_ context.Context, k string) (string, error)

                    GetSecretValue returns the secret if it exists, otherwise an error.

                    type JSONExpander

                    type JSONExpander struct {
                    	// contains filtered or unexported fields
                    }

                    func (*JSONExpander) GetSecretValue

                    func (sm *JSONExpander) GetSecretValue(ctx context.Context, name string) (string, error)

                      GetSecretValue implements the SecretManager interface, but allows for json-expansion of the secret-value. If the secret name contains a period, the secret value is expected to be json. The secret name is assumed to come before the period, while the map-key is expected to follow.

                      For example: If a secret with a name of "psqlcreds" has a value of `{"username":"gandalf", "password":"abc"}` When GetSecretValue(ctx, "psqlcreds") is called, the raw json value will be returned. When GetSecretValue(ctx, "psql.username") is called, only "gandalf" (without quotes) will be returned.

                      type SecretManager

                      type SecretManager interface {
                      	GetSecretValue(ctx context.Context, name string) (string, error)
                      }

                        SecretManager defines the minimum shared functionality for a secret manager used by this application.

                        func NewInMemory

                        func NewInMemory(ctx context.Context, _ *Config) (SecretManager, error)

                          NewInMemory creates a new in-memory secret manager.

                          func NewInMemoryFromMap

                          func NewInMemoryFromMap(ctx context.Context, m map[string]string) (SecretManager, error)

                            NewInMemoryFromMap creates a new in-memory secret manager from the map.

                            func SecretManagerFor

                            func SecretManagerFor(ctx context.Context, cfg *Config) (SecretManager, error)

                              SecretManagerFor returns the secret manager with the given name, or an error if one does not exist.

                              func WrapCacher

                              func WrapCacher(ctx context.Context, sm SecretManager, ttl time.Duration) (SecretManager, error)

                                WrapCacher wraps an existing SecretManager with caching.

                                func WrapJSONExpander

                                func WrapJSONExpander(ctx context.Context, sm SecretManager) (SecretManager, error)

                                  WrapJSONExpander wraps an existing SecretManager with json-expansion logic.

                                  type SecretManagerFunc

                                  type SecretManagerFunc func(context.Context, *Config) (SecretManager, error)

                                    SecretManagerFunc is a func that returns a secret manager or error.