Documentation
¶
Overview ¶
Package secret resolves a value from somewhere other than the environment.
`valueEnv` covers one person: the value is already exported in their shell. It does not cover a team, where the value lives in a password manager and nobody should be exporting it by hand in the first place.
Nothing in this package writes to stdout, and no resolved value is ever returned to anything that renders.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AWSSecretsManager ¶ added in v0.2.0
type AWSSecretsManager struct {
// contains filtered or unexported fields
}
AWSSecretsManager reads through the `aws` CLI, so upkeep never handles an AWS credential itself: the CLI is configured, or it is not and says so.
func (AWSSecretsManager) Scheme ¶ added in v0.2.0
func (AWSSecretsManager) Scheme() string
type GoogleSecretManager ¶ added in v0.2.0
type GoogleSecretManager struct {
// contains filtered or unexported fields
}
GoogleSecretManager reads through the `gcloud` CLI, for the same reason.
func (GoogleSecretManager) Scheme ¶ added in v0.2.0
func (GoogleSecretManager) Scheme() string
type OnePassword ¶
type OnePassword struct {
// contains filtered or unexported fields
}
OnePassword reads through the `op` CLI, so upkeep never handles a vault credential itself: `op` is already signed in, or it is not and says so.
func (OnePassword) Scheme ¶
func (OnePassword) Scheme() string
type Resolver ¶
type Resolver interface {
// Scheme is the prefix that selects this resolver, without "://".
Scheme() string
// Resolve returns the value for a reference, or an error explaining what a
// human should do about it.
Resolve(ctx context.Context, ref string) (string, error)
}
Resolver fetches one value by reference.
type Set ¶
type Set struct {
// contains filtered or unexported fields
}
Set is the resolvers available to a run.
func Default ¶
func Default() *Set
Default is what the CLI uses. Each resolver names one specific tool with a fixed argument shape — never a general "run this" — so a config cannot become a script.
Source Files