vault

type Client ¶

type Client struct {
	// Easy to use wrapper for transit secret engine calls
	Transit *Transit
	// contains filtered or unexported fields
}

Client is a Vault client with Kubernetes support, token automatic renewing and access to Transit Secret Engine wrapper

func NewClient(role string) (*Client, error)

func NewClientFromConfig(config *vaultapi.Config, opts ...ClientOption) (*Client, error)

func NewClientFromRawClient(rawClient *vaultapi.Client, opts ...ClientOption) (*Client, error)

func NewClientWithConfig(config *vaultapi.Config, role, path string) (*Client, error)

func NewClientWithOptions(opts ...ClientOption) (*Client, error)

func (client *Client) Close()

func (client *Client) RawClient() *vaultapi.Client

func (client *Client) Vault() *vaultapi.Client

type ClientAuthMethod ¶ added in v0.6.0

type ClientAuthMethod string

ClientAuthMethod file where the Vault token can be found.

const (
	// AWSEC2AuthMethod is used for the Vault AWS EC2 auth method
	// as described here: https://www.vaultproject.io/docs/auth/aws#ec2-auth-method
	AWSEC2AuthMethod ClientAuthMethod = "aws-ec2"

	// AWSIAMAuthMethod is used for the Vault AWS IAM auth method
	// as described here: https://www.vaultproject.io/docs/auth/aws#iam-auth-method
	AWSIAMAuthMethod ClientAuthMethod = "aws-iam"

	// GCPGCEAuthMethod is used for the Vault GCP GCE auth method
	// as described here: https://www.vaultproject.io/docs/auth/gcp#gce-login
	GCPGCEAuthMethod ClientAuthMethod = "gcp-gce"

	// GCPIAMAuthMethod is used for the Vault GCP IAM auth method
	// as described here: https://www.vaultproject.io/docs/auth/gcp#iam
	GCPIAMAuthMethod ClientAuthMethod = "gcp-iam"

	// JWTAuthMethod is used for the Vault JWT/OIDC/GCP/Kubernetes auth methods
	// as describe here:
	// - https://www.vaultproject.io/docs/auth/jwt
	// - https://www.vaultproject.io/docs/auth/kubernetes
	// - https://www.vaultproject.io/docs/auth/gcp
	JWTAuthMethod ClientAuthMethod = "jwt"

	// AzureMSIAuthMethod is used for the vault Azure auth method
	// as described here:
	// - https://www.vaultproject.io/docs/auth/azure
	AzureMSIAuthMethod ClientAuthMethod = "azure"

	// NamespacedSecretAuthMethod is used for per namespace secrets
	NamespacedSecretAuthMethod ClientAuthMethod = "namespaced"
)

type ClientAuthPath ¶

type ClientAuthPath string

ClientAuthPath is the mount path where the auth method is enabled.

type ClientOption ¶

type ClientOption interface {
	// contains filtered or unexported methods
}

ClientOption configures a Vault client using the functional options paradigm popularized by Rob Pike and Dave Cheney. If you're unfamiliar with this style, see https://commandcenter.blogspot.com/2014/01/self-referential-functions-and-design.html and https://dave.cheney.net/2014/10/17/functional-options-for-friendly-apis.

type ClientRole ¶

type ClientRole string

ClientRole is the vault role which the client would like to receive

type ClientTimeout ¶ added in v0.3.0

type ClientTimeout time.Duration

ClientTimeout after which the client fails.

type ClientToken ¶ added in v0.1.3

type ClientToken string

ClientToken is a Vault token.

type ClientTokenPath ¶

type ClientTokenPath string

ClientTokenPath file where the Vault token can be found.

type ClientURL ¶ added in v0.2.1

type ClientURL string

ClientURL is the vault url EX: https://my-vault.vault.org

type ExistingSecret ¶ added in v0.8.0

type ExistingSecret string

type Logger ¶ added in v0.4.0

type Logger interface {
	// Trace logs a Trace event.
	//
	// Even more fine-grained information than Debug events.
	// Loggers not supporting this level should fall back to Debug.
	Trace(msg string, fields ...map[string]interface{})

	// Debug logs a Debug event.
	//
	// A verbose series of information events.
	// They are useful when debugging the system.
	Debug(msg string, fields ...map[string]interface{})

	// Info logs an Info event.
	//
	// General information about what's happening inside the system.
	Info(msg string, fields ...map[string]interface{})

	// Warn logs a Warn(ing) event.
	//
	// Non-critical events that should be looked at.
	Warn(msg string, fields ...map[string]interface{})

	// Error logs an Error event.
	//
	// Critical events that require immediate attention.
	// Loggers commonly provide Fatal and Panic levels above Error level,
	// but exiting and panicing is out of scope for a logging library.
	Error(msg string, fields ...map[string]interface{})
}

Logger is a unified interface for various logging use cases and practices, including:

• leveled logging
• structured logging

See the original repository for more information: https://github.com/logur/logur

type Transit ¶ added in v0.2.1

type Transit struct {
	// contains filtered or unexported fields
}

Transit is a wrapper for Transit Secret Engine ref: https://www.vaultproject.io/docs/secrets/transit/index.html

func (t *Transit) Decrypt(transitPath, keyID string, ciphertext []byte) ([]byte, error)

func (t *Transit) IsEncrypted(value string) bool

type VaultNamespace ¶ added in v0.8.0

type VaultNamespace string

Vault Enterprise Namespace (not Kubernetes namespace)