package azurekeyvault

import "gocloud.dev/secrets/azurekeyvault"

Package azurekeyvault provides a secrets implementation backed by Azure KeyVault. See https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis for more information. Use OpenKeeper to construct a *secrets.Keeper.

URLs

For secrets.OpenKeeper, azurekeyvault registers for the scheme "azurekeyvault". The default URL opener will use azidentity.DefaultAzureCredential to get credentials.

To customize the URL opener, or for more details on the URL format, see URLOpener. See https://gocloud.dev/concepts/urls/ for background information.

As

azurekeyvault exposes the following type for As: - Error: *azcore.ResponseError.

package main

import (
	"context"
	"log"

	"gocloud.dev/secrets"
)

func main() {
	// PRAGMA: This example is used on gocloud.dev; PRAGMA comments adjust how it is shown and can be ignored.
	// PRAGMA: On gocloud.dev, add a blank import: _ "gocloud.dev/secrets/azurekeyvault"
	// PRAGMA: On gocloud.dev, hide lines until the next blank line.
	ctx := context.Background()

	// The "azurekeyvault" URL scheme is replaced with "https" to construct an Azure
	// Key Vault keyID, as described in https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates.
	// You can add an optional "/{key-version}" to the path to use a specific
	// version of the key; it defaults to the latest version.
	keeper, err := secrets.OpenKeeper(ctx, "azurekeyvault://mykeyvaultname.vault.azure.net/keys/mykeyname")
	if err != nil {
		log.Fatal(err)
	}
	defer keeper.Close()
}

Index ¶

• Constants
• Variables
• func DefaultClientMaker(keyVaultURI string) (*azkeys.Client, error)
• func OpenKeeper(clientMaker ClientMakerT, keyID string, opts *KeeperOptions) (*secrets.Keeper, error)
• type ClientMakerT
• type KeeperOptions
• type URLOpener
• func (o *URLOpener) OpenKeeperURL(ctx context.Context, u *url.URL) (*secrets.Keeper, error)

Examples ¶

• package (OpenFromURL)
• OpenKeeper

Constants ¶

const Scheme = "azurekeyvault"

Scheme is the URL scheme azurekeyvault registers its URLOpener under on secrets.DefaultMux.

Variables ¶

var Set = wire.NewSet(
	DefaultClientMaker,
	wire.Struct(new(URLOpener), "Client"),
)

Set holds Wire providers for this package.

Functions ¶

func DefaultClientMaker ¶

func DefaultClientMaker(keyVaultURI string) (*azkeys.Client, error)

DefaultClientMaker returns a function that constructs a KeyVault Client. By default it uses credentials from the environment; See https://docs.microsoft.com/en-us/go/azure/azure-sdk-go-authorization#use-environment-based-authentication. If the environment variable AZURE_KEYVAULT_AUTH_VIA_CLI is set to a truthy value, it uses credentials from the Azure CLI instead.

func OpenKeeper ¶

func OpenKeeper(clientMaker ClientMakerT, keyID string, opts *KeeperOptions) (*secrets.Keeper, error)

OpenKeeper returns a *secrets.Keeper that uses Azure keyVault.

clientMaker is used to construct an azkeys.Client.

keyID is a Azure Key Vault key identifier like "https://{keyvault-name}.vault.azure.net/keys/{key-name}/{key-version}". The "/{key-version}" suffix is optional; it defaults to the latest version. See https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates for more details.

package main

import (
	"log"

	"gocloud.dev/secrets/azurekeyvault"
)

func main() {
	// PRAGMA: This example is used on gocloud.dev; PRAGMA comments adjust how it is shown and can be ignored.

	// Makes a client to use with the Azure KeyVault API, using default
	// authorization from the environment.
	clientMaker := azurekeyvault.DefaultClientMaker

	// Construct a *secrets.Keeper.
	keeper, err := azurekeyvault.OpenKeeper(clientMaker, "https://mykeyvaultname.vault.azure.net/keys/mykeyname", nil)
	if err != nil {
		log.Fatal(err)
	}
	defer keeper.Close()
}

Types ¶

type ClientMakerT ¶

type ClientMakerT func(keyVaultURI string) (*azkeys.Client, error)

ClientMakerT is the type of a function used to generate a Client.

type KeeperOptions ¶

type KeeperOptions struct {
	// Algorithm sets the encryption algorithm used.
	// Defaults to "RSA-OAEP-256".
	// See https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#jsonwebkeyencryptionalgorithm
	// for more details.
	Algorithm azkeys.JSONWebKeyEncryptionAlgorithm

	// EncryptOptions are passed through to Encrypt.
	EncryptOptions *azkeys.EncryptOptions

	// DecryptOptions are passed through to Decrypt.
	DecryptOptions *azkeys.DecryptOptions
}

KeeperOptions provides configuration options for encryption/decryption operations.

type URLOpener ¶

type URLOpener struct {
	// ClientMaker defaults to DefaultClientMaker.
	ClientMaker ClientMakerT

	// Options specifies the options to pass to OpenKeeper.
	Options KeeperOptions
}

URLOpener opens Azure KeyVault URLs like "azurekeyvault://{keyvault-name}.vault.azure.net/keys/{key-name}/{key-version}?algorithm=RSA-OAEP-256".

The "azurekeyvault" URL scheme is replaced with "https" to construct an Azure Key Vault keyID, as described in https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates. The "/{key-version}"" suffix is optional; it defaults to the latest version.

The "algorithm" query parameter sets the algorithm to use; see https://docs.microsoft.com/en-us/rest/api/keyvault/encrypt/encrypt#jsonwebkeyencryptionalgorithm for supported algorithms. It defaults to "RSA-OAEP-256".

No other query parameters are supported.

func (*URLOpener) OpenKeeperURL ¶

func (o *URLOpener) OpenKeeperURL(ctx context.Context, u *url.URL) (*secrets.Keeper, error)

OpenKeeperURL opens an Azure KeyVault Keeper based on u.

Source Files ¶

akv.go