credentials

Documentation

Overview

Package credentials provides utilities for credentials retrieval and management.

Index

• Constants
• func OnComputeVM(ctx context.Context, metadataProvider MetadataProvider) bool
• type Cache
• type Closer
• type Credentials
• type Invalidator
• type MetadataProvider
• type NoopCache
  • func NewNoopCache() *NoopCache
  • func (n *NoopCache) Delete(string) error
  • func (n *NoopCache) Load(string) (Credentials, error)
  • func (n *NoopCache) Store(string, Credentials) error
• type Provider
  • func AnonymousProvider() Provider
  • func NewServiceAccountProvider(saAuthorizedKey iam.ServiceAccountAuthorizedKey, ...) Provider
  • func StaticProvider(creds Credentials) Provider
• type ProviderFunc
  • func (f ProviderFunc) Provide(ctx context.Context) (Credentials, error)
• type ServiceAccountProvider
  • func (p *ServiceAccountProvider) Close(ctx context.Context) error
  • func (p *ServiceAccountProvider) InvalidateCredentials(context.Context) error
  • func (p *ServiceAccountProvider) Provide(ctx context.Context) (Credentials, error)
• type ServiceAccountProviderOption
  • func WithServiceAccountProviderCache(cache Cache) ServiceAccountProviderOption
  • func WithServiceAccountProviderClock(clock clock.Clock) ServiceAccountProviderOption
  • func WithServiceAccountProviderLogger(logger *zap.Logger) ServiceAccountProviderOption
• type TTLCache
  • func NewTTLCache(opts ...TTLCacheOption) (c *TTLCache, err error)
  • func (c *TTLCache) Close(context.Context) error
  • func (c *TTLCache) Delete(key string) error
  • func (c *TTLCache) Load(key string) (Credentials, error)
  • func (c *TTLCache) Store(key string, credentials Credentials) error
• type TTLCacheOption
  • func WithTTLCacheCapacity(capacity int64) TTLCacheOption
  • func WithTTLCacheCleanPeriod(every time.Duration) TTLCacheOption
  • func WithTTLCacheItemSize(itemSize int64) TTLCacheOption
  • func WithTTLCacheSync(sync bool) TTLCacheOption
• type VMServiceAccountProvider
  • func NewVMServiceAccountProvider(metadataProvider MetadataProvider, opts ...VMServiceAccountProviderOption) *VMServiceAccountProvider
  • func (p *VMServiceAccountProvider) Close(ctx context.Context) error
  • func (p *VMServiceAccountProvider) InvalidateCredentials(context.Context) error
  • func (p *VMServiceAccountProvider) Provide(ctx context.Context) (Credentials, error)
• type VMServiceAccountProviderOption
  • func WithVMServiceAccountProviderCache(cache Cache) VMServiceAccountProviderOption
  • func WithVMServiceAccountProviderClock(clock clock.Clock) VMServiceAccountProviderOption
  • func WithVMServiceAccountProviderLogger(logger *zap.Logger) VMServiceAccountProviderOption
  • func WithVMServiceAccountProviderTokenExpirationDelta(delta time.Duration) VMServiceAccountProviderOption

Constants

const (
	// ErrEntryNotFound is returned when a cache entry is not found.
	ErrEntryNotFound = consterr.Error("cache entry not found")
	// ErrEntryRejected is returned when a cache entry is rejected.
	ErrEntryRejected = consterr.Error("cache entry rejected")
)

const (
	// ErrUnauthorized reports whether the user is not authorized.
	ErrUnauthorized = consterr.Error("unauthorized")

	// DefaultTokenTTL is the default token TTL.
	DefaultTokenTTL = 60 * time.Minute

	// DefaultTokenExpirationDelta is the default token expiration delta.
	DefaultTokenExpirationDelta = 5 * time.Minute
)

Functions

func OnComputeVM

func OnComputeVM(ctx context.Context, metadataProvider MetadataProvider) bool

OnComputeVM returns true if this code is running on a Compute VM. Note: true from this function doesn't guarantee that all the metadata is defined.

Types

type Cache

type Cache interface {
	// Load retrieves a cached credentials entry by key.
	Load(string) (Credentials, error)
	// Store stores a credentials entry in the cache.
	Store(string, Credentials) error
	// Delete removes a credentials entry from the cache.
	Delete(string) error
}

Cache represents a cache for credentials.

type Closer

type Closer interface {
	Close(context.Context) error
}

Closer represents a closer of credentials provider. Provider can optionally implement this interface.

type Credentials

type Credentials struct {
	AccessToken string
	ExpiresAt   time.Time
}

Credentials contains credentials for service clients.

type Invalidator

type Invalidator interface {
	InvalidateCredentials(context.Context) error
}

Invalidator represents a credentials provider that supports cached credentials invalidation.

Commonly used with type assertion on Provider:

if invalidator, ok := provider.(Invalidator); ok {
	err = invalidator.InvalidateCredentials(ctx)
}

type MetadataProvider

type MetadataProvider interface {
	// GetWithContext returns a value from the metadata service.
	GetWithContext(ctx context.Context, key string) (string, error)
}

MetadataProvider represents VM instance metadata provider.

It's compatible with Google Compute Engine (GCE) metadata service provider implementation: https://pkg.go.dev/cloud.google.com/go/compute/metadata.

type NoopCache

type NoopCache struct {
}

NoopCache is a credentials cache implementation that does nothing.

func NewNoopCache

func NewNoopCache() *NoopCache

NewNoopCache creates a new NoopCache instance.

func (*NoopCache) Delete

func (n *NoopCache) Delete(string) error

func (*NoopCache) Load

func (n *NoopCache) Load(string) (Credentials, error)

func (*NoopCache) Store

func (n *NoopCache) Store(string, Credentials) error

type Provider

type Provider interface {
	Provide(context.Context) (Credentials, error)
}

Provider represents a provider of credentials for service clients.

func AnonymousProvider

func AnonymousProvider() Provider

AnonymousProvider is an anonymous credentials provider. Returns an empty credentials.

func NewServiceAccountProvider

func NewServiceAccountProvider(
	saAuthorizedKey iam.ServiceAccountAuthorizedKey,
	tokenIssuer client.IssueServiceAccountToken,
	opts ...ServiceAccountProviderOption,
) Provider

NewServiceAccountProvider creates a new service account credentials provider.

func StaticProvider

func StaticProvider(creds Credentials) Provider

StaticProvider is a static credentials provider.

type ProviderFunc

type ProviderFunc func(context.Context) (Credentials, error)

ProviderFunc is an adapter to allow the use of ordinary functions as credentials provider.

func (ProviderFunc) Provide

func (f ProviderFunc) Provide(ctx context.Context) (Credentials, error)

type ServiceAccountProvider

type ServiceAccountProvider struct {
	// contains filtered or unexported fields
}

ServiceAccountProvider is a service account credentials provider.

func (*ServiceAccountProvider) Close

func (p *ServiceAccountProvider) Close(ctx context.Context) error

Close closes the provider underlaying resources.

func (*ServiceAccountProvider) InvalidateCredentials

func (p *ServiceAccountProvider) InvalidateCredentials(context.Context) error

InvalidateCredentials invalidates cached credentials.

func (*ServiceAccountProvider) Provide

func (p *ServiceAccountProvider) Provide(ctx context.Context) (Credentials, error)

Provide returns the corresponding credentials for the service account specified in the key.

type ServiceAccountProviderOption

type ServiceAccountProviderOption func(*ServiceAccountProvider)

ServiceAccountProviderOption is a functional option for the service account credentials provider.

func WithServiceAccountProviderCache

func WithServiceAccountProviderCache(cache Cache) ServiceAccountProviderOption

WithServiceAccountProviderCache sets the cache for the service account credentials provider.

func WithServiceAccountProviderClock

func WithServiceAccountProviderClock(clock clock.Clock) ServiceAccountProviderOption

WithServiceAccountProviderClock sets the clock for the service account credentials provider.

func WithServiceAccountProviderLogger

func WithServiceAccountProviderLogger(logger *zap.Logger) ServiceAccountProviderOption

WithServiceAccountProviderLogger sets the logger for the service account credentials provider.

type TTLCache

type TTLCache struct {
	// contains filtered or unexported fields
}

TTLCache is a credentials cache with TTL support.

func NewTTLCache

func NewTTLCache(opts ...TTLCacheOption) (c *TTLCache, err error)

NewTTLCache creates a new TTLCache instance with the specified options.

func (*TTLCache) Close

func (c *TTLCache) Close(context.Context) error

Close stops all goroutines and closes all channels.

func (*TTLCache) Delete

func (c *TTLCache) Delete(key string) error

Delete deletes credentials by key from the cache if it exists.

func (*TTLCache) Load

func (c *TTLCache) Load(key string) (Credentials, error)

Load loads credentials from the cache by key.

func (*TTLCache) Store

func (c *TTLCache) Store(key string, credentials Credentials) error

Store stores credentials in the cache with a TTL based on the token expiration time.

type TTLCacheOption

type TTLCacheOption func(*TTLCache)

TTLCacheOption is a functional option for configuring a TTLCache.

func WithTTLCacheCapacity

func WithTTLCacheCapacity(capacity int64) TTLCacheOption

WithTTLCacheCapacity sets the maximum cache capacity, default - 1e4.

func WithTTLCacheCleanPeriod

func WithTTLCacheCleanPeriod(every time.Duration) TTLCacheOption

WithTTLCacheCleanPeriod sets the cache clean period. Rounded down to the nearest second. Cannot be less than 1 second. Default - 1 second.

func WithTTLCacheItemSize

func WithTTLCacheItemSize(itemSize int64) TTLCacheOption

WithTTLCacheItemSize sets the size of each item in the cache, default - 1024.

func WithTTLCacheSync

func WithTTLCacheSync(sync bool) TTLCacheOption

WithTTLCacheSync sets the synchronous/asynchronous operation mode:

• sync - element is available immediately after addition; lower performance
• async - element may not be immediately available after addition; higher performance

type VMServiceAccountProvider

type VMServiceAccountProvider struct {
	// contains filtered or unexported fields
}

VMServiceAccountProvider is a credentials provider that issues credentials for the service account connected to the running VM.

func NewVMServiceAccountProvider

func NewVMServiceAccountProvider(
	metadataProvider MetadataProvider,
	opts ...VMServiceAccountProviderOption,
) *VMServiceAccountProvider

NewVMServiceAccountProvider creates a new VM service account credentials provider.

func (*VMServiceAccountProvider) Close

func (p *VMServiceAccountProvider) Close(ctx context.Context) error

Close closes the provider underlaying resources.

func (*VMServiceAccountProvider) InvalidateCredentials

func (p *VMServiceAccountProvider) InvalidateCredentials(context.Context) error

InvalidateCredentials invalidates cached credentials.

func (*VMServiceAccountProvider) Provide

func (p *VMServiceAccountProvider) Provide(ctx context.Context) (Credentials, error)

Provide returns credentials for the service account connected to the VM.

type VMServiceAccountProviderOption

type VMServiceAccountProviderOption func(*VMServiceAccountProvider)

VMServiceAccountProviderOption is a functional option for the VM service account credentials provider.

func WithVMServiceAccountProviderCache

func WithVMServiceAccountProviderCache(cache Cache) VMServiceAccountProviderOption

WithVMServiceAccountProviderCache sets the cache for the VM service account credentials provider.

func WithVMServiceAccountProviderClock

func WithVMServiceAccountProviderClock(clock clock.Clock) VMServiceAccountProviderOption

WithVMServiceAccountProviderClock sets the clock for the VM service account credentials provider.

func WithVMServiceAccountProviderLogger

func WithVMServiceAccountProviderLogger(logger *zap.Logger) VMServiceAccountProviderOption

WithVMServiceAccountProviderLogger sets the logger for the VM service account credentials provider.

func WithVMServiceAccountProviderTokenExpirationDelta

func WithVMServiceAccountProviderTokenExpirationDelta(delta time.Duration) VMServiceAccountProviderOption

WithVMServiceAccountProviderTokenExpirationDelta sets the token expiration delta for the VM service account credentials provider.