auth

type AppRoleSecretProvider ¶

type AppRoleSecretProvider struct {
	// contains filtered or unexported fields
}

AppRoleSecretProvider provides a vault secret by issuing a auth/approle/login.

https://www.vaultproject.io/docs/auth/approle.html

func NewAppRoleSecretProvider(vaultRoleID, vaultSecretID, approleAuthBackendName string) *AppRoleSecretProvider

func (a *AppRoleSecretProvider) GetSecret(client Client) (*vaultapi.Secret, error)

type Authenticator ¶

type Authenticator struct {
	// contains filtered or unexported fields
}

Authenticator authenticates a vault client using a given SecretProvider strategy.

The Authenticator renews the currently issued vault auth token on demand at least 5 seconds before the last issued token expires.

func NewAuthenticator(secretProvider SecretProvider) *Authenticator

func (a *Authenticator) Authenticate(client Client) error

type Client ¶

type Client interface {
	SetToken(v string)
	Read(path string) (*vaultapi.Secret, error)
	RawWrite(path string, data map[string]interface{}) (*vaultapi.Secret, error)
}

type KubernetesClientSet ¶

type KubernetesClientSet interface {
	GetJWT() (string, error)
}

type KubernetesSecretProvider ¶

type KubernetesSecretProvider struct {
	// contains filtered or unexported fields
}

KubernetesSecretProvider provides a vault secret by issuing a auth/kubernetes/login.

https://www.vaultproject.io/docs/auth/kubernetes.html

func NewKubernetesSecretProvider(
	vaultRoleID,
	vaultKubernetesAuthBackendName string,
	kubernetesClientSet KubernetesClientSet,
) *KubernetesSecretProvider

func (a *KubernetesSecretProvider) GetSecret(client Client) (*vaultapi.Secret, error)

type SecretProvider ¶

type SecretProvider interface {
	GetSecret(client Client) (*vaultapi.Secret, error)
}

SecretProvider can provide a vault secret by using one of the vault auth methods.

https://www.vaultproject.io/docs/auth/index.html

type TokenAuthenticator ¶

type TokenAuthenticator struct {
	// contains filtered or unexported fields
}

TokenAuthenticator authenticates the vault client with fixed auth token.

NOTE: This authentication method is used mainly for development.

func NewTokenAuthenticator(token string) *TokenAuthenticator

func (a *TokenAuthenticator) Authenticate(client Client) error

type TokenInfo ¶

type TokenInfo struct {
	TokenID            string
	TokenAccessor      string
	TokenDuration      time.Duration
	TokenExpireTimeUTC time.Time
	TokenRenewable     bool
}

TokenInfo holds a vault token information.