Documentation
¶
Overview ¶
Package secrets decrypts the age encrypted files a site keeps beside its configuration, and has the sops command decrypt its Secret documents.
Plaintext is returned in memory and streamed to wherever it is needed. It is never written to the workstation's disk, which is what the exec wrappers of the shell toolkit were careful about and what this package keeps.
Index ¶
- Constants
- func AgeIdentities(files []IdentityFile) []age.Identity
- func Decrypt(path string, identities []age.Identity) ([]byte, error)
- func DecryptSops(ctx context.Context, s *Sops, data []byte, keys SopsKeys, sections []string) (map[string]map[string]string, error)
- func DefaultSopsKeyTypes() []string
- func Identities(paths []string) ([]age.Identity, error)
- func SopsValueType(s string) (string, bool)
- type IdentityFile
- type Sops
- type SopsFound
- type SopsInfo
- type SopsKey
- type SopsKeys
Constants ¶
const MinSopsVersion = "3.10.0"
MinSopsVersion is the oldest sops clusterctl decrypts with: 3.10.0 is the first that reads the file from stdin and opens it with an OpenSSH key.
Variables ¶
This section is empty.
Functions ¶
func AgeIdentities ¶ added in v0.4.0
func AgeIdentities(files []IdentityFile) []age.Identity
AgeIdentities are the identities the files hold, in order.
func DecryptSops ¶
func DecryptSops(ctx context.Context, s *Sops, data []byte, keys SopsKeys, sections []string) (map[string]map[string]string, error)
DecryptSops has sops decrypt a sops encrypted YAML file into memory and returns the values of the given top level mappings, by key.
Before sops runs, the file is checked the way loading checks it, a kind of master key keys.Types does not trust is refused, and so is a value sops would parse as anything but a string. sops is then given exactly those bytes, on stdin, so the file cannot change in between.
The data key is recovered with the files of keys.Identities that hold a recipient of the file, one run each, and then, with keys.Discover, by whatever sops finds itself; that run keeps the terminal, and the progress displays of ctx leave it meanwhile. sops verifies the integrity of the whole file before it writes anything. It writes the plaintext to a pipe, as JSON, so that no value is typed again, and nothing reaches the disk.
No error says anything of the values: what sops prints is passed on only when it could not open the data key, and then it lists the keys it tried.
func DefaultSopsKeyTypes ¶ added in v0.3.0
func DefaultSopsKeyTypes() []string
DefaultSopsKeyTypes are the kinds of master key trusted when the workstation names none: age, which needs nothing but a local identity.
func Identities ¶
Identities loads the age identities used to decrypt, as IdentityFiles reads them.
func SopsValueType ¶ added in v0.3.0
SopsValueType returns the type sops recorded for an encrypted value, and whether the value is one sops encrypted at all.
sops parses the plaintext as this type after decrypting it, but the type is outside what the encryption authenticates: anyone who can write the file can change it, and the parser's error then quotes the plaintext. Only "str" is read.
Types ¶
type IdentityFile ¶ added in v0.4.0
type IdentityFile struct {
// Identities are the age identities the file holds.
Identities []age.Identity
// Path is the file, absolute, since sops runs in another directory.
Path string
// SSH is set for an OpenSSH private key, which sops reads from another
// variable than age identities.
SSH bool
// contains filtered or unexported fields
}
IdentityFile is one file of workstation.identities: the identities it holds, which open an age encrypted file, and its path, by which sops is given it, since sops opens the file itself and no key is copied anywhere.
func IdentityFiles ¶ added in v0.4.0
func IdentityFiles(paths []string) ([]IdentityFile, error)
IdentityFiles reads the identities of workstation.identities and notes which recipients each file opens. A file sops is pointed at is read and checked here first: sops would prompt for the passphrase of an encrypted key, or run the plugin an identity names.
A file may hold age identities or an OpenSSH private key; both are accepted, because a site usually already has ssh keys and no reason to issue a second kind.
func (IdentityFile) Opens ¶ added in v0.4.0
func (f IdentityFile) Opens(recipient string) bool
Opens reports whether the file holds the identity of an age recipient, as sops writes one into its metadata.
type Sops ¶ added in v0.4.0
type Sops struct {
// Binary is the command, "sops" when empty. A bare name is looked up
// in PATH, as the ssh client is.
Binary string
// contains filtered or unexported fields
}
Sops is the sops command clusterctl decrypts with.
type SopsInfo ¶
type SopsInfo struct {
// Keys are the master keys the data key is encrypted to, as sops names
// their type ("age", "pgp", "kms", "gcp_kms", "azure_kv", "hc_vault",
// "hckms") and the key itself, for example an age recipient or a key
// ARN.
Keys []SopsKey
// Groups is the number of key groups, Threshold the number of them
// needed to recover the data key when there are several.
Groups int
Threshold int
// LastModified is when sops last wrote the file.
LastModified time.Time
// EncryptedRegex is the rule that chose which values were encrypted.
EncryptedRegex string
}
SopsInfo describes a sops encrypted document, read without decrypting it.
func InspectSops ¶
InspectSops reads the sops metadata of a YAML file without decrypting anything, so that a damaged or hand edited file is reported when the configuration loads rather than when a node is half way through a reinstall. It needs neither a key nor sops.
func (SopsInfo) CheckKeyTypes ¶ added in v0.3.0
CheckKeyTypes refuses a document encrypted to a kind of master key that is not trusted here. The metadata that names the keys is not covered by the message authentication code, so anyone who can write the file can add a Vault or a key management service there, and sops would send this machine's credentials to it.
type SopsKeys ¶ added in v0.3.0
type SopsKeys struct {
// Identities are the files of workstation.identities. They are tried
// first, and only those that hold a recipient of the file.
Identities []IdentityFile
// Discover lets sops look for keys itself as well: SOPS_AGE_KEY_FILE
// and its other variables, ~/.config/sops/age/keys.txt, a PGP agent,
// the credentials of a cloud key management service or Vault. That can
// run a program or ask for a passphrase, so it is for a terminal only.
Discover bool
// Types are the kinds of master key trusted, DefaultSopsKeyTypes when
// empty. A file encrypted to any other kind is refused.
Types []string
}
SopsKeys says which keys may open a sops file.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package sopstest writes sops encrypted files for tests with the sops command, the way "sops encrypt --encrypted-regex '^(data|binaryData)$'" writes them, to keys generated by the test, so that no private key is kept in the repository.
|
Package sopstest writes sops encrypted files for tests with the sops command, the way "sops encrypt --encrypted-regex '^(data|binaryData)$'" writes them, to keys generated by the test, so that no private key is kept in the repository. |