secrets

Documentation

Index

• Constants
• Variables
• func Decrypt(encodedValue string, masterKey []byte) ([]byte, error)
• func Encrypt(plainText []byte, masterKey []byte) (string, error)
• func FormatSecretForStdout(key string, value string, raw bool) string
• func GetSecretKeys(vault *Vault, requestedKeys []string) []string
• func HashPasswordForWorkspace(password string) (string, error)
• func NormalizeEncrypted(encrypted string) string
• func ProcessEnvSecret(envVarName string, value []byte, force bool) error
• func ProcessVault(vault *Vault, opts ProcessOptions) (map[string]string, error)
• func ResolveDestination(secret VaultSecret) (string, error)
• func ResolveEncryptedValue(encrypted string) (string, error)
• func ResolveMasterKey(flagValue string) ([]byte, error)
• func ResolveVaultPath(inputFlag string) (string, error)
• func ValidateSecret(name string, secret VaultSecret) error
• type ProcessOptions
• type SecretTypeConfig
• type Vault
  • func LoadVault(path string) (*Vault, error)
• type VaultSecret

Constants

const (
	Argon2Time    = 3
	Argon2Memory  = 64 * 1024 // 64MB
	Argon2Threads = 4
	Argon2KeyLen  = 32
	SaltLen       = 16
	NonceLen      = 12
)

const (
	TypeGeneric          = "generic"
	TypeSSH              = "ssh"
	TypeEnv              = "env"
	TypeKubeconfig       = "kubeconfig"
	TypeDockerConfigJSON = "dockerconfigjson"
)

Variables

var SecretTypeConfigs = map[string]SecretTypeConfig{
	TypeGeneric: {
		DefaultMode:      "0o600",
		DefaultDirectory: "",
	},
	TypeSSH: {
		DefaultMode:      "0o600",
		DefaultDirectory: "~/.ssh",
	},
	TypeEnv: {
		DefaultMode:      "0o644",
		DefaultDirectory: "",
	},
	TypeKubeconfig: {
		DefaultMode:      "0o600",
		DefaultDirectory: "~/.kube",
	},
	TypeDockerConfigJSON: {
		DefaultMode:      "0o600",
		DefaultDirectory: "~/.docker",
	},
}

Functions

func Decrypt

func Decrypt(encodedValue string, masterKey []byte) ([]byte, error)

func Encrypt

func Encrypt(plainText []byte, masterKey []byte) (string, error)

func FormatSecretForStdout

func FormatSecretForStdout(key string, value string, raw bool) string

func GetSecretKeys

func GetSecretKeys(vault *Vault, requestedKeys []string) []string

func HashPasswordForWorkspace

func HashPasswordForWorkspace(password string) (string, error)

func NormalizeEncrypted

func NormalizeEncrypted(encrypted string) string

func ProcessEnvSecret

func ProcessEnvSecret(envVarName string, value []byte, force bool) error

func ProcessVault

func ProcessVault(vault *Vault, opts ProcessOptions) (map[string]string, error)

func ResolveDestination

func ResolveDestination(secret VaultSecret) (string, error)

func ResolveEncryptedValue

func ResolveEncryptedValue(encrypted string) (string, error)

func ResolveMasterKey

func ResolveMasterKey(flagValue string) ([]byte, error)

func ResolveVaultPath

func ResolveVaultPath(inputFlag string) (string, error)

func ValidateSecret

func ValidateSecret(name string, secret VaultSecret) error

Types

type ProcessOptions

type ProcessOptions struct {
	MasterKey    []byte
	Keys         []string
	Stdout       bool
	Raw          bool
	Force        bool
	ModeOverride string
}

type SecretTypeConfig

type SecretTypeConfig struct {
	DefaultMode      string
	DefaultDirectory string
}

type Vault

type Vault struct {
	Secrets map[string]VaultSecret `yaml:"secrets"`
}

func LoadVault

func LoadVault(path string) (*Vault, error)

type VaultSecret

type VaultSecret struct {
	Type        string `yaml:"type,omitempty"`
	Encrypted   string `yaml:"encrypted"`
	Destination string `yaml:"destination"`
	Mode        string `yaml:"mode,omitempty"`
	Force       bool   `yaml:"force,omitempty"`
}