Documentation
¶
Overview ¶
Package azurekeyvault provides a secrets implementation backed by Azure KeyVault. See https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis for more information. Use OpenKeeper to construct a *secrets.Keeper.
URLs ¶
For secrets.OpenKeeper, azurekeyvault registers for the scheme "azurekeyvault". The default URL opener will use Dial, which gets default credentials from the environment. To customize the URL opener, or for more details on the URL format, see URLOpener. See https://gocloud.dev/concepts/urls/ for background information.
As ¶
azurekeyvault exposes the following type for As: - Error: autorest.DetailedError, see https://godoc.org/github.com/Azure/go-autorest/autorest#DetailedError
Example (OpenFromURL) ¶
package main
import (
"context"
"log"
"gocloud.dev/secrets"
)
func main() {
ctx := context.Background()
// secrets.OpenKeeper creates a *secrets.Keeper from a URL.
// The URL's host holds the KeyVault name.
// The first element of the URL's path holds the key name.
// The second element of the URL's path, if included, holds the key version.
// The "algorithm" query parameter (required) holds the algorithm.
// See https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt
// for more information.
keeper, err := secrets.OpenKeeper(ctx, "azurekeyvault://mykeyvaultname/mykeyname?algorithm=RSA-OAEP-256")
if err != nil {
log.Fatal(err)
}
defer keeper.Close()
}
Output:
Index ¶
Examples ¶
Constants ¶
const Scheme = "azurekeyvault"
Scheme is the URL scheme azurekeyvault registers its URLOpener under on secrets.DefaultMux.
Variables ¶
var Set = wire.NewSet( Dial, KeeperOptions{}, URLOpener{}, )
Set holds Wire providers for this package.
Functions ¶
func Dial ¶
func Dial() (*keyvault.BaseClient, error)
Dial gets a new *keyvault.BaseClient, see https://godoc.org/github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault#BaseClient
func OpenKeeper ¶ added in v0.13.0
func OpenKeeper(client *keyvault.BaseClient, keyVaultName, keyName, keyVersion string, opts *KeeperOptions) (*secrets.Keeper, error)
OpenKeeper returns a *secrets.Keeper that uses Azure keyVault. List of Parameters: - client: *keyvault.BaseClient instance, see https://godoc.org/github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault#BaseClient - keyVaultName: string representing the KeyVault name, see https://docs.microsoft.com/en-us/azure/key-vault/common-parameters-and-headers - keyName: string representing the keyName, see https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#uri-parameters - keyVersion: string representing the keyVersion, or ""; see https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#uri-parameters - opts: *KeeperOptions with the desired Algorithm to use for operations. See this link for more info: https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#jsonwebkeyencryptionalgorithm
Example ¶
package main
import (
"context"
"log"
"github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault"
akv "gocloud.dev/secrets/azurekeyvault"
)
func main() {
// Get a client to use with the Azure KeyVault API.
// See API docs for Authentication options.
// https://github.com/Azure/azure-sdk-for-go
client, err := akv.Dial()
if err != nil {
log.Fatal(err)
}
// Construct a *secrets.Keeper.
// List of Parameters:
// - client: *keyvault.BaseClient instance, see https://godoc.org/github.com/Azure/azure-sdk-for-go/services/keyvault/v7.0/keyvault#BaseClient
// - keyVaultName: string representing the KeyVault name, see https://docs.microsoft.com/en-us/azure/key-vault/common-parameters-and-headers
// - keyName: string representing the keyName, see https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#uri-parameters
// - keyVersion: string representing the keyVersion, see https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#uri-parameters
// - opts: *KeeperOptions with the desired Algorithm to use for operations. See this link for more info: https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#jsonwebkeyencryptionalgorithm
keeper, err := akv.OpenKeeper(
client,
"replace with keyVaultName",
"replace with keyName",
"", // replace with keyVersion if you don't want to use the default one.
&akv.KeeperOptions{
Algorithm: string(keyvault.RSAOAEP256),
},
)
if err != nil {
log.Fatal(err)
}
defer keeper.Close()
// Now we can use keeper to encrypt or decrypt.
ctx := context.Background()
plaintext := []byte("Hello, Secrets!")
ciphertext, err := keeper.Encrypt(ctx, plaintext)
if err != nil {
log.Fatal(err)
}
decrypted, err := keeper.Decrypt(ctx, ciphertext)
if err != nil {
log.Fatal(err)
}
_ = decrypted
}
Output:
Types ¶
type KeeperOptions ¶
type KeeperOptions struct {
Algorithm string
}
KeeperOptions provides configuration options for encryption/decryption operations.
type URLOpener ¶
type URLOpener struct {
// Client must be set to a non-nil value.
Client *keyvault.BaseClient
// Options specifies the options to pass to OpenKeeper.
Options KeeperOptions
}
URLOpener opens Azure KeyVault URLs like "azurekeyvault://mykeyvaultname/mykeyname/mykeyversion?algorithm=RSA-OAEP-256".
- The URL's host holds the KeyVault name (https://docs.microsoft.com/en-us/azure/key-vault/common-parameters-and-headers).
- The first element of the URL's path holds the key name (https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#uri-parameters).
- The second element of the URL's path, if included, holds the key version (https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#uri-parameter).
- The "algorithm" query parameter (required) holds the algorithm (https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#jsonwebkeyencryptionalgorithm).
No other query parameters are supported.
Source Files