README
¶
Vault Secret Service
This package implements platform.SecretService using vault.
Key layout
All secrets are stored in vault as key value pairs that can be found under
the key /secret/data/:orgID.
For example
/secret/data/031c8cbefe101000 ->
github_api_key: foo
some_other_key: bar
a_secret: key
Configuration
When a new secret service is instatiated with vault.NewSecretService() we read the
environment for the standard vault environment variables.
It is expected that the vault provided is unsealed and that the VAULT_TOKEN has sufficient privileges to access the key space described above.
Test/Dev
The vault secret service may be used by starting a vault server
vault server -dev
VAULT_ADDR='<vault address>' VAULT_TOKEN='<vault token>' influxd --secret-store vault
Once the vault and influxdb servers have been started and initialized, you may test the service by executing the following:
curl --request GET \
--url http://localhost:9999/api/v2/orgs/<org id>/secrets \
--header 'authorization: Token <authorization token>
# should return
#
# {
# "links": {
# "org": "/api/v2/orgs/031c8cbefe101000",
# "secrets": "/api/v2/orgs/031c8cbefe101000/secrets"
# },
# "secrets": []
# }
curl --request PATCH \
--url http://localhost:9999/api/v2/orgs/<org id>/secrets \
--header 'authorization: Token <authorization token> \
--header 'content-type: application/json' \
--data '{
"foo": "bar",
"hello": "world"
}'
# should return 204 no content
curl --request GET \
--url http://localhost:9999/api/v2/orgs/<org id>/secrets \
--header 'authorization: Token <authorization token>
# should return
#
# {
# "links": {
# "org": "/api/v2/orgs/031c8cbefe101000",
# "secrets": "/api/v2/orgs/031c8cbefe101000/secrets"
# },
# "secrets": [
# "foo",
# "hello"
# ]
# }
Documentation
¶
Index ¶
- type Config
- type ConfigOptFn
- type SecretService
- func (s *SecretService) DeleteSecret(ctx context.Context, orgID platform.ID, ks ...string) error
- func (s *SecretService) GetSecretKeys(ctx context.Context, orgID platform.ID) ([]string, error)
- func (s *SecretService) LoadSecret(ctx context.Context, orgID platform.ID, k string) (string, error)
- func (s *SecretService) PatchSecrets(ctx context.Context, orgID platform.ID, m map[string]string) error
- func (s *SecretService) PutSecret(ctx context.Context, orgID platform.ID, k string, v string) error
- func (s *SecretService) PutSecrets(ctx context.Context, orgID platform.ID, m map[string]string) error
- type TLSConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Address string
AgentAddress string
ClientTimeout time.Duration
MaxRetries int
Token string
TLSConfig
}
Config may setup the vault client configuration. If any field is a zero value, it will be ignored and the default used.
type ConfigOptFn ¶
ConfigOptFn is a functional input option to configure a vault service.
func WithConfig ¶
func WithConfig(config Config) ConfigOptFn
WithConfig provides a configuration to the service constructor.
func WithTLSConfig ¶
func WithTLSConfig(tlsCFG TLSConfig) ConfigOptFn
WithTLSConfig allows one to set the TLS config only.
type SecretService ¶
SecretService is service for storing user secrets
func NewSecretService ¶
func NewSecretService(cfgOpts ...ConfigOptFn) (*SecretService, error)
NewSecretService creates an instance of a SecretService. The service is configured using the standard vault environment variables. https://www.vaultproject.io/docs/commands/index.html#environment-variables
func (*SecretService) DeleteSecret ¶
DeleteSecret removes a single secret from the secret store.
func (*SecretService) GetSecretKeys ¶
GetSecretKeys retrieves all secret keys that are stored for the organization orgID.
func (*SecretService) LoadSecret ¶
func (s *SecretService) LoadSecret(ctx context.Context, orgID platform.ID, k string) (string, error)
LoadSecret retrieves the secret value v found at key k for organization orgID.
func (*SecretService) PatchSecrets ¶
func (s *SecretService) PatchSecrets(ctx context.Context, orgID platform.ID, m map[string]string) error
PatchSecrets patches all provided secrets and updates any previous values.
func (*SecretService) PutSecret ¶
PutSecret stores the secret pair (k,v) for the organization orgID.
func (*SecretService) PutSecrets ¶
func (s *SecretService) PutSecrets(ctx context.Context, orgID platform.ID, m map[string]string) error
PutSecrets puts all provided secrets and overwrites any previous values.
Source Files