secrets

Documentation

Overview

Package secrets defines a minimum abstract interface for a secret manager. Allows for a different implementation to be bound within the ServeEnv.

Although exported, this package is non intended for general consumption. It is a shared dependency between multiple exposure notifications projects. We cannot guarantee that there won't be breaking changes in the future.

Index

• Constants
• func RegisterManager(name string, fn SecretManagerFunc)
• func RegisteredManagers() []string
• func Resolver(sm SecretManager, config *Config) envconfig.MutatorFunc
• type Cacher
  • func (sm *Cacher) GetSecretValue(ctx context.Context, name string) (string, error)
• type Config
• type InMemory
  • func (m *InMemory) GetSecretValue(_ context.Context, k string) (string, error)
• type JSONExpander
  • func (sm *JSONExpander) GetSecretValue(ctx context.Context, name string) (string, error)
• type SecretManager
  • func NewInMemory(ctx context.Context, _ *Config) (SecretManager, error)
  • func NewInMemoryFromMap(ctx context.Context, m map[string]string) (SecretManager, error)
  • func SecretManagerFor(ctx context.Context, cfg *Config) (SecretManager, error)
  • func WrapCacher(ctx context.Context, sm SecretManager, ttl time.Duration) (SecretManager, error)
  • func WrapJSONExpander(ctx context.Context, sm SecretManager) (SecretManager, error)
• type SecretManagerFunc

Constants

const (
	// SecretPrefix is the prefix, that if the value of an env var starts with
	// will be resolved through the configured secret store.
	SecretPrefix = "secret://"

	// FileSuffix is the suffix to use, if this secret path should be written to a file.
	// only interpreted on environment variable values that start w/ secret://
	FileSuffix = "?target=file"
)

Functions

func RegisterManager

func RegisterManager(name string, fn SecretManagerFunc)

RegisterManager registers a new secret manager with the given name. If a manager is already registered with the given name, it panics. Managers are usually registered via an init function.

func RegisteredManagers

func RegisteredManagers() []string

RegisteredManagers returns the list of the names of the registered secret managers.

func Resolver

func Resolver(sm SecretManager, config *Config) envconfig.MutatorFunc

Resolver returns a function that fetches secrets from the secret manager. If the provided secret manager is nil, the function is nil, Otherwise, it looks for values prefixed with secret:// and resolves them as secrets. For slice functions, values separated by commas are processed as individual secrets.

Types

type Cacher

type Cacher struct {
	// contains filtered or unexported fields
}

Cacher is a secret manager implementation that wraps another secret manager and caches secret values.

func (*Cacher) GetSecretValue

func (sm *Cacher) GetSecretValue(ctx context.Context, name string) (string, error)

GetSecretValue implements the SecretManager interface, but caches values and retrieves them from the cache.

type Config

type Config struct {
	Type            string        `env:"SECRET_MANAGER, default=IN_MEMORY"`
	SecretsDir      string        `env:"SECRETS_DIR, default=/var/run/secrets"`
	SecretCacheTTL  time.Duration `env:"SECRET_CACHE_TTL, default=5m"`
	SecretExpansion bool          `env:"SECRET_EXPANSION, default=false"`
}

Config represents the config for a secret manager.

type InMemory

type InMemory struct {
	// contains filtered or unexported fields
}

InMemory is an in-memory secret manager, primarily used for testing.

func (*InMemory) GetSecretValue

func (m *InMemory) GetSecretValue(_ context.Context, k string) (string, error)

GetSecretValue returns the secret if it exists, otherwise an error.

type JSONExpander

type JSONExpander struct {
	// contains filtered or unexported fields
}

func (*JSONExpander) GetSecretValue

func (sm *JSONExpander) GetSecretValue(ctx context.Context, name string) (string, error)

GetSecretValue implements the SecretManager interface, but allows for json-expansion of the secret-value. If the secret name contains a period, the secret value is expected to be json. The secret name is assumed to come before the period, while the map-key is expected to follow.

For example: If a secret with a name of "psqlcreds" has a value of `{"username":"gandalf", "password":"abc"}` When GetSecretValue(ctx, "psqlcreds") is called, the raw json value will be returned. When GetSecretValue(ctx, "psql.username") is called, only "gandalf" (without quotes) will be returned.

type SecretManager

type SecretManager interface {
	GetSecretValue(ctx context.Context, name string) (string, error)
}

SecretManager defines the minimum shared functionality for a secret manager used by this application.

func NewInMemory

func NewInMemory(ctx context.Context, _ *Config) (SecretManager, error)

NewInMemory creates a new in-memory secret manager.

func NewInMemoryFromMap

func NewInMemoryFromMap(ctx context.Context, m map[string]string) (SecretManager, error)

NewInMemoryFromMap creates a new in-memory secret manager from the map.

func SecretManagerFor

func SecretManagerFor(ctx context.Context, cfg *Config) (SecretManager, error)

SecretManagerFor returns the secret manager with the given name, or an error if one does not exist.

func WrapCacher

func WrapCacher(ctx context.Context, sm SecretManager, ttl time.Duration) (SecretManager, error)

WrapCacher wraps an existing SecretManager with caching.

func WrapJSONExpander

func WrapJSONExpander(ctx context.Context, sm SecretManager) (SecretManager, error)

WrapJSONExpander wraps an existing SecretManager with json-expansion logic.

type SecretManagerFunc

type SecretManagerFunc func(context.Context, *Config) (SecretManager, error)

SecretManagerFunc is a func that returns a secret manager or error.