keyvault

Overview ¶

Package keyvault provides access to Azure's Keyvault service.

For details on the keyvault service, see: https://azure.microsoft.com/en-us/services/key-vault/

For general information on the XML API: https://docs.microsoft.com/en-us/rest/api/keyvault/

Below are some examples of using common sub-packages. For more detailed information, options and examples, see the individual packages.

Creating a client with MSI authorizer ¶

To begin using this package, create an Authorizer and a client targeting your keyvault endpoint:

msi, err := keyvault.MSIAuth(msiClientID, keyvault.PublicCloud)
if err != nil {
	// Do something
}

// This creates your client. The "vaultName" is a standin fo
// your unique vault name (not the FQDN).
client, err := keyvault.New("vaultName", keyvault.PublicCloud, msi)
if err != nil {
	// Do something
}

Accessing a text secret ¶

You can access a secret by accessing the secret package and calling a method:

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()

secret, _, err := client.Secrets().Get(ctx, "text-secret")
if err != nil {
	// Do something
}
fmt.Println(string(secret))

Accessing a binary secret ¶

Some secrets represent binary data Base64 encoded. Retrieval is simple:

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()

secret, _, err := client.Secrets().Get(ctx, "binary-secret", secrets.Base64Decode())
if err != nil {
	// Do something
}

Retrieve a TLS cert for Golang webserver ¶

Getting a TLS cert to serve up for a Golang HTTP server is easy:

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()

// We automatically deal with PKCS12 or PEM decoding.
cert, _, err := client.TLS().ServiceCert(ctx, "certname")
if err != nil {
	// Do something
}

cfg := &tls.Config{Certificates: []tls.Certificate{cert}}
srv := &http.Server{
	TLSConfig:    cfg,
	ReadTimeout:  time.Minute,
	WriteTimeout: time.Minute,
}
log.Fatal(srv.ListenAndServeTLS("", ""))