vault

var (
	// ErrVaultEmptyResponse is returned when vault respondes with no data
	ErrVaultEmptyResponse = errors.New("no data returned from vault")
	// ErrVaultUnexpectedResponse is returned when vault does not respond with the expected data
	ErrVaultUnexpectedResponse = errors.New("unexpected response from vault")
	// ErrNotInKubernetes is returned when vestibule is not running in a kubernetes cluster
	ErrNotInKubernetes = errors.New("not running in kubernetes cluster")
	// ErrInvalidKVKey is returned when the given key is invalid
	ErrInvalidKVKey = errors.New("invalid vault KV key")
	// ErrUnexpectedVaultResponse is returned when vault returns something we cannot handle
	ErrUnexpectedVaultResponse = errors.New("unexpected response from vault")

	// EnvVars is a map of known vonfiguration environment variables and their usage descriptions
	EnvVars = map[string]string{
		EnvVaultKeys: `If VAULT_KV_KEYS is set, will iterate over each key (colon separated), attempting to get the secret from Vault.
Secrets are pulled at the optional version or latest, then injected into Environ. If running in Kubernetes,
the Pod's ServiceAccount token will automatically be looked up and used for Vault authentication.
e.g. VAULT_KV_KEYS=/path/to/key1[@version]:/path/to/key2[@version]:...`,
		EnvVaultAwsRole: `Name of the aws role to generate credentials against. If credentials are returned, the access key and secret key will be injected into
the process environment using the standard environment variables and a credentials file will be written to
the path from AWS_SHARED_CREDENTIALS_FILE (by default "/var/run/aws/credentials")`,
		"VAULT_*":               "All vault client configuration environment variables are respected. More information at https://www.vaultproject.io/docs/commands/#environment-variables",
		EnvVaultIamRole:         "[DEPRECATED] Name of the aws role to generate credentials against.",
		EnvAwsProfile:           `AWS profile to use in the shared credentials file. Defaults to "default"`,
		EnvAwsSharedCredFile:    `Path to the AWS shared credentials file to write credentials to. Defaults to "/var/run/aws/credentials"`,
		EnvGoogleCredFile:       `Path to the GCP service account credentials file to create. Defaults to "/var/run/gcp/creds.json"`,
		EnvVaultAppJWT:          "The jwt for use with OIDC/JWT authentication",
		EnvVaultAppRole:         "Either the role id for AppRole authentication, or the role name fo Kubernetes authentication.",
		EnvVaultAppSecret:       "The secret id for use with AppRole authentication",
		EnvVaultAuthData:        "Data payload to send with authentication request. JSON object.",
		EnvVaultAuthMethod:      `Authentication method for vault. Default is "kubernetes".`,
		EnvVaultAuthPath:        "Authentication path for vault authentication - e.g. okta/login/:user. Overrides VAULT_AUTH_METHOD if set.",
		EnvVaultAwsPath:         `Mountpoint for the vault AWS secret engine. Defaults to "aws".`,
		EnvVaultGcpCredType:     "GCP credential type to generate. Defaults to key. Accepted values are [token key]",
		EnvVaultGcpPath:         `Mountpoint for the vault GCP secret engine. Defaults to "gcp".`,
		EnvVaultGcpRole:         "Name of the GCP role in vault to generate credentials against.",
		EnvVestExposeVaultToken: "Should we expose the resulting vault token, even if vest generated it, for the sub-process? (POTENTIALLY INSECURE -- USE WITH CAUTION!)",
	}
)