Documentation ¶
Index ¶
- Constants
- Variables
- type AzureBackend
- type Backend
- type Cache
- type ConsulBackend
- func (c *ConsulBackend) Delete(key string) error
- func (c *ConsulBackend) DetectHostAddr() (string, error)
- func (c *ConsulBackend) Get(key string) (*Entry, error)
- func (c *ConsulBackend) HAEnabled() bool
- func (c *ConsulBackend) List(prefix string) ([]string, error)
- func (c *ConsulBackend) LockWith(key, value string) (Lock, error)
- func (c *ConsulBackend) NotifyActiveStateChange() error
- func (c *ConsulBackend) NotifySealedStateChange() error
- func (c *ConsulBackend) Put(entry *Entry) error
- func (c *ConsulBackend) RunServiceDiscovery(waitGroup *sync.WaitGroup, shutdownCh ShutdownChannel, redirectAddr string, ...) (err error)
- type ConsulLock
- type DynamoDBBackend
- func (d *DynamoDBBackend) Delete(key string) error
- func (d *DynamoDBBackend) Get(key string) (*Entry, error)
- func (d *DynamoDBBackend) HAEnabled() bool
- func (d *DynamoDBBackend) List(prefix string) ([]string, error)
- func (d *DynamoDBBackend) LockWith(key, value string) (Lock, error)
- func (d *DynamoDBBackend) Put(entry *Entry) error
- type DynamoDBLock
- type DynamoDBRecord
- type Entry
- type Etcd2Backend
- func (c *Etcd2Backend) Delete(key string) error
- func (c *Etcd2Backend) Get(key string) (*Entry, error)
- func (e *Etcd2Backend) HAEnabled() bool
- func (c *Etcd2Backend) List(prefix string) ([]string, error)
- func (c *Etcd2Backend) LockWith(key, value string) (Lock, error)
- func (c *Etcd2Backend) Put(entry *Entry) error
- type Etcd2Lock
- type EtcdBackend
- func (c *EtcdBackend) Delete(key string) error
- func (c *EtcdBackend) Get(key string) (*Entry, error)
- func (e *EtcdBackend) HAEnabled() bool
- func (c *EtcdBackend) List(prefix string) ([]string, error)
- func (c *EtcdBackend) LockWith(key, value string) (Lock, error)
- func (c *EtcdBackend) Put(entry *Entry) error
- type EtcdLock
- type Factory
- type FileBackend
- type GCSBackend
- type HABackend
- type InmemBackend
- type InmemHABackend
- type InmemLock
- type Lock
- type MySQLBackend
- type PermitPool
- type PostgreSQLBackend
- type RedirectDetect
- type S3Backend
- type ServiceDiscovery
- type ShutdownChannel
- type SwiftBackend
- type ZookeeperBackend
- func (c *ZookeeperBackend) Delete(key string) error
- func (c *ZookeeperBackend) Get(key string) (*Entry, error)
- func (c *ZookeeperBackend) HAEnabled() bool
- func (c *ZookeeperBackend) List(prefix string) ([]string, error)
- func (c *ZookeeperBackend) LockWith(key, value string) (Lock, error)
- func (c *ZookeeperBackend) Put(entry *Entry) error
- type ZookeeperHALock
Constants ¶
const ( // DefaultDynamoDBRegion is used when no region is configured // explicitly. DefaultDynamoDBRegion = "us-east-1" // DefaultDynamoDBTableName is used when no table name // is configured explicitly. DefaultDynamoDBTableName = "vault-dynamodb-backend" // DefaultDynamoDBReadCapacity is the default read capacity // that is used when none is configured explicitly. DefaultDynamoDBReadCapacity = 5 // DefaultDynamoDBWriteCapacity is the default write capacity // that is used when none is configured explicitly. DefaultDynamoDBWriteCapacity = 5 // DynamoDBEmptyPath is the string that is used instead of // empty strings when stored in DynamoDB. DynamoDBEmptyPath = " " // DynamoDBLockPrefix is the prefix used to mark DynamoDB records // as locks. This prefix causes them not to be returned by // List operations. DynamoDBLockPrefix = "_" // DynamoDBLockRetryInterval is the amount of time to wait // if a lock fails before trying again. DynamoDBLockRetryInterval = time.Second // DynamoDBWatchRetryMax is the number of times to re-try a // failed watch before signaling that leadership is lost. DynamoDBWatchRetryMax = 5 // DynamoDBWatchRetryInterval is the amount of time to wait // if a watch fails before trying again. DynamoDBWatchRetryInterval = 5 * time.Second )
const ( // Ideally, this prefix would match the "_" used in the file backend, but // that prefix has special meaining in etcd. Specifically, it excludes those // entries from directory listings. Etcd2NodeFilePrefix = "." // The lock prefix can (and probably should) cause an entry to be excluded // from diretory listings, so "_" works here. Etcd2NodeLockPrefix = "_" // The delimiter is the same as the `-C` flag of etcdctl. Etcd2MachineDelimiter = "," // The lock TTL matches the default that Consul API uses, 15 seconds. Etcd2LockTTL = 15 * time.Second // The amount of time to wait between the semaphore key renewals Etcd2LockRenewInterval = 5 * time.Second // The amount of time to wait if a watch fails before trying again. Etcd2WatchRetryInterval = time.Second // The number of times to re-try a failed watch before signaling that leadership is lost. Etcd2WatchRetryMax = 5 )
const (
// DefaultCacheSize is used if no cache size is specified for NewCache
DefaultCacheSize = 32 * 1024
)
const DefaultParallelOperations = 128
const ( // DefaultServiceName is the default Consul service name used when // advertising a Vault instance. DefaultServiceName = "vault" )
const ( // ZKNodeFilePrefix is prefixed to any "files" in ZooKeeper, // so that they do not collide with directory entries. Otherwise, // we cannot delete a file if the path is a full-prefix of another // key. ZKNodeFilePrefix = "_" )
Variables ¶
var ( EtcdSyncConfigError = errors.New("client setup failed: unable to parse etcd sync field in config") EtcdSyncClusterError = errors.New("client setup failed: unable to sync etcd cluster") EtcdAddressError = errors.New("client setup failed: address must be valid URL (ex. 'scheme://host:port')") EtcdSemaphoreKeysEmptyError = errors.New("lock queue is empty") EtcdLockHeldError = errors.New("lock already held") EtcdLockNotHeldError = errors.New("lock not held") EtcdSemaphoreKeyRemovedError = errors.New("semaphore key removed before lock aquisition") EtcdVersionUnknow = errors.New("etcd: unknown API version") )
var MaxBlobSize = 1024 * 1024 * 4
MaxBlobSize at this time
Functions ¶
This section is empty.
Types ¶
type AzureBackend ¶
type AzureBackend struct {
// contains filtered or unexported fields
}
AzureBackend is a physical backend that stores data within an Azure blob container.
func (*AzureBackend) Delete ¶
func (a *AzureBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*AzureBackend) Get ¶
func (a *AzureBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*AzureBackend) List ¶
func (a *AzureBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*AzureBackend) Put ¶
func (a *AzureBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type Backend ¶
type Backend interface { // Put is used to insert or update an entry Put(entry *Entry) error // Get is used to fetch an entry Get(key string) (*Entry, error) // Delete is used to permanently delete an entry Delete(key string) error // List is used ot list all the keys under a given // prefix, up to the next prefix. List(prefix string) ([]string, error) }
Backend is the interface required for a physical backend. A physical backend is used to durably store data outside of Vault. As such, it is completely untrusted, and is only accessed via a security barrier. The backends must represent keys in a hierarchical manner. All methods are expected to be thread safe.
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
Cache is used to wrap an underlying physical backend and provide an LRU cache layer on top. Most of the reads done by Vault are for policy objects so there is a large read reduction by using a simple write-through cache.
type ConsulBackend ¶
type ConsulBackend struct {
// contains filtered or unexported fields
}
ConsulBackend is a physical backend that stores data at specific prefix within Consul. It is used for most production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*ConsulBackend) Delete ¶
func (c *ConsulBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*ConsulBackend) DetectHostAddr ¶
func (c *ConsulBackend) DetectHostAddr() (string, error)
DetectHostAddr is used to detect the host address by asking the Consul agent
func (*ConsulBackend) Get ¶
func (c *ConsulBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*ConsulBackend) HAEnabled ¶
func (c *ConsulBackend) HAEnabled() bool
HAEnabled indicates whether the HA functionality should be exposed. Currently always returns true.
func (*ConsulBackend) List ¶
func (c *ConsulBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*ConsulBackend) LockWith ¶
func (c *ConsulBackend) LockWith(key, value string) (Lock, error)
Lock is used for mutual exclusion based on the given key.
func (*ConsulBackend) NotifyActiveStateChange ¶
func (c *ConsulBackend) NotifyActiveStateChange() error
func (*ConsulBackend) NotifySealedStateChange ¶
func (c *ConsulBackend) NotifySealedStateChange() error
func (*ConsulBackend) Put ¶
func (c *ConsulBackend) Put(entry *Entry) error
Put is used to insert or update an entry
func (*ConsulBackend) RunServiceDiscovery ¶
func (c *ConsulBackend) RunServiceDiscovery(waitGroup *sync.WaitGroup, shutdownCh ShutdownChannel, redirectAddr string, activeFunc activeFunction, sealedFunc sealedFunction) (err error)
type ConsulLock ¶
type ConsulLock struct {
// contains filtered or unexported fields
}
ConsulLock is used to provide the Lock interface backed by Consul
func (*ConsulLock) Lock ¶
func (c *ConsulLock) Lock(stopCh <-chan struct{}) (<-chan struct{}, error)
func (*ConsulLock) Unlock ¶
func (c *ConsulLock) Unlock() error
type DynamoDBBackend ¶
type DynamoDBBackend struct {
// contains filtered or unexported fields
}
DynamoDBBackend is a physical backend that stores data in a DynamoDB table. It can be run in high-availability mode as DynamoDB has locking capabilities.
func (*DynamoDBBackend) Delete ¶
func (d *DynamoDBBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*DynamoDBBackend) Get ¶
func (d *DynamoDBBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*DynamoDBBackend) HAEnabled ¶
func (d *DynamoDBBackend) HAEnabled() bool
func (*DynamoDBBackend) List ¶
func (d *DynamoDBBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*DynamoDBBackend) LockWith ¶
func (d *DynamoDBBackend) LockWith(key, value string) (Lock, error)
LockWith is used for mutual exclusion based on the given key.
func (*DynamoDBBackend) Put ¶
func (d *DynamoDBBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type DynamoDBLock ¶
type DynamoDBLock struct {
// contains filtered or unexported fields
}
DynamoDBLock implements a lock using an DynamoDB client.
func (*DynamoDBLock) Lock ¶
func (l *DynamoDBLock) Lock(stopCh <-chan struct{}) (doneCh <-chan struct{}, retErr error)
Lock tries to acquire the lock by repeatedly trying to create a record in the DynamoDB table. It will block until either the stop channel is closed or the lock could be acquired successfully. The returned channel will be closed once the lock is deleted or changed in the DynamoDB table.
func (*DynamoDBLock) Unlock ¶
func (l *DynamoDBLock) Unlock() error
Unlock releases the lock by deleting the lock record from the DynamoDB table.
type DynamoDBRecord ¶
DynamoDBRecord is the representation of a vault entry in DynamoDB. The vault key is split up into two components (Path and Key) in order to allow more efficient listings.
type Etcd2Backend ¶
type Etcd2Backend struct {
// contains filtered or unexported fields
}
Etcd2Backend is a physical backend that stores data at specific prefix within etcd. It is used for most production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*Etcd2Backend) Delete ¶
func (c *Etcd2Backend) Delete(key string) error
Delete is used to permanently delete an entry.
func (*Etcd2Backend) Get ¶
func (c *Etcd2Backend) Get(key string) (*Entry, error)
Get is used to fetch an entry.
func (*Etcd2Backend) HAEnabled ¶
func (e *Etcd2Backend) HAEnabled() bool
HAEnabled indicates whether the HA functionality should be exposed. Currently always returns true.
func (*Etcd2Backend) List ¶
func (c *Etcd2Backend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*Etcd2Backend) LockWith ¶
func (c *Etcd2Backend) LockWith(key, value string) (Lock, error)
Lock is used for mutual exclusion based on the given key.
func (*Etcd2Backend) Put ¶
func (c *Etcd2Backend) Put(entry *Entry) error
Put is used to insert or update an entry.
type Etcd2Lock ¶
type Etcd2Lock struct {
// contains filtered or unexported fields
}
Etcd2Lock emplements a lock using and Etcd2 backend.
func (*Etcd2Lock) Lock ¶
Lock attempts to acquire the lock by waiting for a new semaphore key in etcd to become the first in the queue and will block until it is successful or it receives a signal on the provided channel. The returned channel will be closed when the lock is lost, either by an explicit call to Unlock or by the associated semaphore key in etcd otherwise being deleted or expiring.
If the lock is currently held by this instance of Etcd2Lock, Lock will return an Etcd2LockHeldError error.
type EtcdBackend ¶
type EtcdBackend struct {
// contains filtered or unexported fields
}
EtcdBackend is a physical backend that stores data at specific prefix within etcd. It is used for most production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*EtcdBackend) Delete ¶
func (c *EtcdBackend) Delete(key string) error
func (*EtcdBackend) HAEnabled ¶
func (e *EtcdBackend) HAEnabled() bool
func (*EtcdBackend) LockWith ¶
func (c *EtcdBackend) LockWith(key, value string) (Lock, error)
Lock is used for mutual exclusion based on the given key.
func (*EtcdBackend) Put ¶
func (c *EtcdBackend) Put(entry *Entry) error
type EtcdLock ¶
type EtcdLock struct {
// contains filtered or unexported fields
}
EtcdLock emplements a lock using and etcd backend.
type FileBackend ¶
type FileBackend struct { Path string // contains filtered or unexported fields }
FileBackend is a physical backend that stores data on disk at a given file path. It can be used for durable single server situations, or to develop locally where durability is not critical.
WARNING: the file backend implementation is currently extremely unsafe and non-performant. It is meant mostly for local testing and development. It can be improved in the future.
func (*FileBackend) Delete ¶
func (b *FileBackend) Delete(path string) error
func (*FileBackend) Put ¶
func (b *FileBackend) Put(entry *Entry) error
type GCSBackend ¶
type GCSBackend struct {
// contains filtered or unexported fields
}
GCSBackend is a physical backend that stores data within an Google Cloud Storage bucket.
func (*GCSBackend) Delete ¶
func (g *GCSBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*GCSBackend) Get ¶
func (g *GCSBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*GCSBackend) List ¶
func (g *GCSBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*GCSBackend) Put ¶
func (g *GCSBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type HABackend ¶
type HABackend interface { // LockWith is used for mutual exclusion based on the given key. LockWith(key, value string) (Lock, error) // Whether or not HA functionality is enabled HAEnabled() bool }
HABackend is an extensions to the standard physical backend to support high-availability. Vault only expects to use mutual exclusion to allow multiple instances to act as a hot standby for a leader that services all requests.
type InmemBackend ¶
type InmemBackend struct {
// contains filtered or unexported fields
}
InmemBackend is an in-memory only physical backend. It is useful for testing and development situations where the data is not expected to be durable.
func NewInmem ¶
func NewInmem(logger log.Logger) *InmemBackend
NewInmem constructs a new in-memory backend
func (*InmemBackend) Delete ¶
func (i *InmemBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*InmemBackend) Get ¶
func (i *InmemBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*InmemBackend) List ¶
func (i *InmemBackend) List(prefix string) ([]string, error)
List is used ot list all the keys under a given prefix, up to the next prefix.
func (*InmemBackend) Put ¶
func (i *InmemBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type InmemHABackend ¶
type InmemHABackend struct { InmemBackend // contains filtered or unexported fields }
func NewInmemHA ¶
func NewInmemHA(logger log.Logger) *InmemHABackend
NewInmemHA constructs a new in-memory HA backend. This is only for testing.
func (*InmemHABackend) HAEnabled ¶
func (i *InmemHABackend) HAEnabled() bool
HAEnabled indicates whether the HA functionality should be exposed. Currently always returns true.
func (*InmemHABackend) LockMapSize ¶
func (i *InmemHABackend) LockMapSize() int
LockMapSize is used in some tests to determine whether this backend has ever been used for HA purposes rather than simply for storage
type InmemLock ¶
type InmemLock struct {
// contains filtered or unexported fields
}
InmemLock is an in-memory Lock implementation for the HABackend
type Lock ¶
type Lock interface { // Lock is used to acquire the given lock // The stopCh is optional and if closed should interrupt the lock // acquisition attempt. The return struct should be closed when // leadership is lost. Lock(stopCh <-chan struct{}) (<-chan struct{}, error) // Unlock is used to release the lock Unlock() error // Returns the value of the lock and if it is held Value() (bool, string, error) }
type MySQLBackend ¶
type MySQLBackend struct {
// contains filtered or unexported fields
}
MySQLBackend is a physical backend that stores data within MySQL database.
func (*MySQLBackend) Delete ¶
func (m *MySQLBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*MySQLBackend) Get ¶
func (m *MySQLBackend) Get(key string) (*Entry, error)
Get is used to fetch and entry.
func (*MySQLBackend) List ¶
func (m *MySQLBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*MySQLBackend) Put ¶
func (m *MySQLBackend) Put(entry *Entry) error
Put is used to insert or update an entry.
type PermitPool ¶
type PermitPool struct {
// contains filtered or unexported fields
}
PermitPool is used to limit maximum outstanding requests
func NewPermitPool ¶
func NewPermitPool(permits int) *PermitPool
NewPermitPool returns a new permit pool with the provided number of permits
func (*PermitPool) Acquire ¶
func (c *PermitPool) Acquire()
Acquire returns when a permit has been acquired
type PostgreSQLBackend ¶
type PostgreSQLBackend struct {
// contains filtered or unexported fields
}
PostgreSQL Backend is a physical backend that stores data within a PostgreSQL database.
func (*PostgreSQLBackend) Delete ¶
func (m *PostgreSQLBackend) Delete(fullPath string) error
Delete is used to permanently delete an entry
func (*PostgreSQLBackend) Get ¶
func (m *PostgreSQLBackend) Get(fullPath string) (*Entry, error)
Get is used to fetch and entry.
func (*PostgreSQLBackend) List ¶
func (m *PostgreSQLBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*PostgreSQLBackend) Put ¶
func (m *PostgreSQLBackend) Put(entry *Entry) error
Put is used to insert or update an entry.
type RedirectDetect ¶
type RedirectDetect interface { // DetectHostAddr is used to detect the host address DetectHostAddr() (string, error) }
RedirectDetect is an optional interface that an HABackend can implement. If they do, a redirect address can be automatically detected.
type S3Backend ¶
type S3Backend struct {
// contains filtered or unexported fields
}
S3Backend is a physical backend that stores data within an S3 bucket.
type ServiceDiscovery ¶
type ServiceDiscovery interface { // NotifyActiveStateChange is used by Core to notify a backend // capable of ServiceDiscovery that this Vault instance has changed // its status to active or standby. NotifyActiveStateChange() error // NotifySealedStateChange is used by Core to notify a backend // capable of ServiceDiscovery that Vault has changed its Sealed // status to sealed or unsealed. NotifySealedStateChange() error // Run executes any background service discovery tasks until the // shutdown channel is closed. RunServiceDiscovery(waitGroup *sync.WaitGroup, shutdownCh ShutdownChannel, redirectAddr string, activeFunc activeFunction, sealedFunc sealedFunction) error }
ServiceDiscovery is an optional interface that an HABackend can implement. If they do, the state of a backend is advertised to the service discovery network.
type SwiftBackend ¶
type SwiftBackend struct {
// contains filtered or unexported fields
}
SwiftBackend is a physical backend that stores data within an OpenStack Swift container.
func (*SwiftBackend) Delete ¶
func (s *SwiftBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*SwiftBackend) Get ¶
func (s *SwiftBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*SwiftBackend) List ¶
func (s *SwiftBackend) List(prefix string) ([]string, error)
List is used to list all the keys under a given prefix, up to the next prefix.
func (*SwiftBackend) Put ¶
func (s *SwiftBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type ZookeeperBackend ¶
type ZookeeperBackend struct {
// contains filtered or unexported fields
}
ZookeeperBackend is a physical backend that stores data at specific prefix within Zookeeper. It is used in production situations as it allows Vault to run on multiple machines in a highly-available manner.
func (*ZookeeperBackend) Delete ¶
func (c *ZookeeperBackend) Delete(key string) error
Delete is used to permanently delete an entry
func (*ZookeeperBackend) Get ¶
func (c *ZookeeperBackend) Get(key string) (*Entry, error)
Get is used to fetch an entry
func (*ZookeeperBackend) HAEnabled ¶
func (c *ZookeeperBackend) HAEnabled() bool
HAEnabled indicates whether the HA functionality should be exposed. Currently always returns true.
func (*ZookeeperBackend) List ¶
func (c *ZookeeperBackend) List(prefix string) ([]string, error)
List is used ot list all the keys under a given prefix, up to the next prefix.
func (*ZookeeperBackend) LockWith ¶
func (c *ZookeeperBackend) LockWith(key, value string) (Lock, error)
LockWith is used for mutual exclusion based on the given key.
func (*ZookeeperBackend) Put ¶
func (c *ZookeeperBackend) Put(entry *Entry) error
Put is used to insert or update an entry
type ZookeeperHALock ¶
type ZookeeperHALock struct {
// contains filtered or unexported fields
}
ZookeeperHALock is a Zookeeper Lock implementation for the HABackend
func (*ZookeeperHALock) Lock ¶
func (i *ZookeeperHALock) Lock(stopCh <-chan struct{}) (<-chan struct{}, error)
func (*ZookeeperHALock) Unlock ¶
func (i *ZookeeperHALock) Unlock() error