-- import "."
const (
// PathTokenLookupSelf Used for Policy Creation
PathTokenLookupSelf = "auth/token/lookup-self"
// PathTokenRevokeSelf Used for Policy Creation
PathTokenRevokeSelf = "auth/token/revoke-self"
// PathSysCapabilitiesSelf Used for Policy Creation
PathSysCapabilitiesSelf = "sys/capabilities-self"
)func GetConfig(ctx context.Context, path string) (data []byte, err error)GetConfig returns config from vault. The path format is '/{secret engine name}/{secret name}'
Example: data, err := vault.GetConfig(context.Background(), "/kv/foo")
func GetConfigLoad(ctx context.Context, path string, model interface{}) (err error)GetConfigLoad returns config and loaded into a variable The path format is '/{secret engine name}/{secret name}'
func GetKeyValue(ctx context.Context, key string) (data []byte, err error)GetKeyValue returns key value store from vault. 'Key' is the key name. Like for example 'ms-order-conf'
func GetKeyValueLoad(ctx context.Context, key string, model interface{}) (err error)GetKeyValueLoad returns config and loaded into a variable 'Key' is the key name. Like for example 'ms-order-conf'
func Init(token string, opts ...OptionFunc) (err error)Init enables global top level functions
func RenewTokenOther(ctx context.Context, token string) (err error)RenewTokenOther attempts to renew passed token using self's token
func RenewTokenOverride(ctx context.Context, token string) (err error)RenewTokenOverride attempts to renew passed token with passed token as auth
func RenewTokenSelf(ctx context.Context) (err error)RenewTokenSelf attempts to renew token registered to self
func TransitDecrypt(ctx context.Context, key, cipherText string) (data []byte, err error)TransitDecrypt decrypts a transit encrypted payload
func TransitDecryptStream(ctx context.Context, key string, cipher io.Reader) (payload io.Reader, err error)TransitDecryptStream decrypts a transit encrypted payload in streaming manner. Best usage is if you expect a big ciphertext from whatever your source is.
func TransitEncrypt(ctx context.Context, key string, payload []byte) (cipherText string, err error)TransitEncrypt will encrypt payload for sending somewhere else. 'key' is the encryptor name.
func TransitEncryptStream(ctx context.Context, key string, payload io.Reader) (cipher io.Reader, err error)TransitEncryptStream will encrypt payload in stream manner to prevent memory overload on huge number of operation. Use this function for big files. The returned io Reader is a stream of pure encoded vault data.
func UpsertPolicy(ctx context.Context, policy string, permissions map[string][]Capability) (err error)UpsertPolicy creates/updates a policy. Token used in the instance must have the permission to even update policy itself. Root token have all permissions
type APIVersion stringAPIVersion the base type is string
const (
// V2 Version is not supported until Hashicorp says otherwise
V2 APIVersion = "v2"
// V1 Default version used
V1 APIVersion = "v1"
)type Capability stringCapability s
const (
// CapabilityRead Determines if the token will be able to access the resource. Used for Policy Creation
CapabilityRead Capability = "read"
// CapabilityUpdate Determines if the token will be able to update the resource. Used for Policy Creation
CapabilityUpdate Capability = "update"
// CapabilityList Determines if the token will be able to LIST resources (not access them). Used for Policy Creation
CapabilityList Capability = "list"
// CapabilityDelete Determines if the token can delete a resource. Used for Policy Creation
CapabilityDelete Capability = "delete"
)type Config struct {
Token string // Required
Host string // Optional. Defaults to https://127.0.0.1:8200. Make sure to not add '/' in last character
NoRenew bool // Optional. Defaults to false, so it will attempt to renew token every time Renew Timing passes.
NoRenewOnInitialize bool // Optional. Defaults to false, which will indeed renew on initiazlie. Will not renew if NoRenew is set to true
RenewTiming string // Optional. Defaults to 0 0 * * * (Every midnight). Uses cron tab syntax.
VaultAPIVersion APIVersion // Optional. Defaults to v1
HTTPClient *http.Client // Uses default http client if nil
KeyValueEngine string
TransitEngine string
}Config struct
type ConfigResponse struct {
RequestID string `json:"request_id"`
LeaseID string `json:"lease_id"`
Renewable bool `json:"renewable"`
LeaseDuration int `json:"lease_duration"`
WrapInfo interface{} `json:"wrap_info"`
Warnings []string `json:"warnings"`
Data json.RawMessage `json:"data"`
}ConfigResponse struct
type CreateTokenInstance struct {
ID string `json:"id,omitempty"`
RoleName string `json:"role_name,omitempty"`
Policies []string `json:"policies,omitempty"`
Meta map[string]string `json:"meta,omitempty"`
NoParent bool `json:"no_parent,omitempty"`
NoDefaultPolicy bool `json:"no_default_policy,omitempty"`
Renewable bool `json:"renewable,omitempty"`
TTL string `json:"ttl,omitempty"`
Type string `json:"type,omitempty"`
ExplicitMaxTTL string `json:"explicit_max_ttl,omitempty"`
DisplayName string `json:"display_name,omitempty"`
NumUses int `json:"num_uses,omitempty"`
EntityAlias string `json:"entity_alias,omitempty"`
Period string `json:"period,omitempty"`
}CreateTokenInstance struct to create token
func CreateNewToken() *CreateTokenInstanceCreateNewToken creates an instance of Token override. Call .Do(ctx) on the
instance to actually create new token. Default value for instance follows vault
token documentation, on here:
https://www.vaultproject.io/api/auth/token#parameters
Which means the new token will be renewable by default and has display name of 'token'
func (c *CreateTokenInstance) Do(ctx context.Context) (token string, err error)Do creates the token.
func (c *CreateTokenInstance) DoOverride(ctx context.Context, authToken string) (token string, err error)DoOverride creates the token, with passed token as auth and parent if orphan status is false (or no parent is true)
func (c *CreateTokenInstance) WithCurrentTokenAsParent(b bool) *CreateTokenInstanceWithCurrentTokenAsParent Uses instance token as parent. Default true. If using DoOverride(token), the override token will be set as parent instead.
func (c *CreateTokenInstance) WithDefaultPolicy(b bool) *CreateTokenInstanceWithDefaultPolicy replaces instance default policy. by default true
func (c *CreateTokenInstance) WithDisplayName(s string) *CreateTokenInstanceWithDisplayName replaces token display name
func (c *CreateTokenInstance) WithEntityAlias(s string) *CreateTokenInstanceWithEntityAlias replaces instance entity alias. MUST BE USED alongside WithRoleName and Role name must exist within vault.
func (c *CreateTokenInstance) WithExplicitMaxTTL(t time.Duration) *CreateTokenInstanceWithExplicitMaxTTL replaces instance explicit time to live, which by default will depends on Vault's default lease TTL If this method is called, duration will be rounded down to the nearest hour argument passed with minimum value of 1 hour
func (c *CreateTokenInstance) WithID(id string) *CreateTokenInstanceWithID replaces instance ID. Make sure there's no character '.' in the argument string
func (c *CreateTokenInstance) WithMeta(metadata map[string]string) *CreateTokenInstanceWithMeta replaces instance metadata
func (c *CreateTokenInstance) WithNumberOfUses(i int) *CreateTokenInstanceWithNumberOfUses replaces token's allowed number of usage. Signing in to vault using UI with the token is considered used one time. By default 0, which is infinite.
func (c *CreateTokenInstance) WithPeriod(t time.Duration) *CreateTokenInstanceWithPeriod replaces token period. Token that is not renewed in this set of time cannot be renewed again. By default, if unset will follow's Vault's default lease TTL. Has minimum value of 1 hour. Only hourly is supported in this package.
func (c *CreateTokenInstance) WithPolicies(policies ...string) *CreateTokenInstanceWithPolicies replaces instance policies
func (c *CreateTokenInstance) WithRenewableStatus(b bool) *CreateTokenInstanceWithRenewableStatus replaces instance renewable. default true.
func (c *CreateTokenInstance) WithRoleName(rolename string) *CreateTokenInstanceWithRoleName replaces instance rolename.
func (c *CreateTokenInstance) WithSetAsBatchToken() *CreateTokenInstanceWithSetAsBatchToken replaces instance token type
func (c *CreateTokenInstance) WithSetAsServiceToken() *CreateTokenInstanceWithSetAsServiceToken replaces instance token type
func (c *CreateTokenInstance) WithTimeToLive(t time.Duration) *CreateTokenInstanceWithTimeToLive replaces instance time to live, which by default will depends on Vault's default lease TTL If this method is called, duration will be rounded down to the nearest hour argument passed with minimum value of 1 hour Only hourly is supported in this package.
type LookupToken struct {
Data struct {
Accessor string `json:"accessor"`
CreationTime int64 `json:"creation_time"`
CreationTTL int64 `json:"creation_ttl"`
DisplayName string `json:"display_name"`
EntityID string `json:"entity_id"`
ExpireTime interface{} `json:"expire_time"`
ExplicitMaxTTL int64 `json:"explicit_max_ttl"`
ID string `json:"id"` // This is the token auth
Meta map[string]string `json:"meta"`
NumUses int64 `json:"num_uses"`
Orphan bool `json:"orphan"`
Path string `json:"path"`
Policies []string `json:"policies"`
TTL int64 `json:"ttl"`
Type string `json:"type"`
} `json:"data"`
RequestID string `json:"request_id"`
LeaseID string `json:"lease_id"`
Renewable bool `json:"renewable"`
LeaseDuration int64 `json:"lease_duration"`
WrapInfo interface{} `json:"wrap_info"`
Warnings []string `json:"warnings"`
Auth interface{} `json:"auth"`
}LookupToken token lookup
func LookupOther(ctx context.Context, token string) (lookup LookupToken, err error)LookupOther lookup information on current token used in the instance
func LookupSelf(ctx context.Context) (token LookupToken, err error)LookupSelf lookup information on current token used in the instance
type OptionFunc func(options *Config)OptionFunc opts
func WithAPIVersion(version APIVersion) OptionFuncfunc WithHost(hostname string) OptionFuncfunc WithHttpClient(httpClient *http.Client) OptionFuncfunc WithKeyValueEngine(engine string) OptionFuncfunc WithTransitEngine(engine string) OptionFunctype Options struct {
Host string // Optional. Defaults to https://127.0.0.1:8200. Make sure to not add '/' in last character
VaultAPIVersion APIVersion // Optional. Defaults to v1
HTTPClient *http.Client // Uses default http client if nil
}Options struct
type PolicyData struct {
Name string `json:"name"`
Policy string `json:"policy"`
}PolicyData struct
func CheckPolicy(ctx context.Context, policy string) (d PolicyData, err error)CheckPolicy checks if policy exists and gets it's data
type PolicyResponse struct {
RequestID string `json:"request_id"`
LeaseID string `json:"lease_id"`
Renewable bool `json:"renewable"`
LeaseDuration int `json:"lease_duration"`
WrapInfo interface{} `json:"wrap_info"`
Warnings []string `json:"warnings"`
Data PolicyData `json:"data"`
}PolicyResponse struct
type Vault struct {
BaseURL string
Config Config
}Vault struct
func NewClient(token string, opts ...OptionFunc) (*Vault, error)NewClient creates a new vault instance
func (v *Vault) CheckPolicy(ctx context.Context, policy string) (d PolicyData, err error)CheckPolicy checks if policy exists and gets it's data
func (v *Vault) CreateNewToken() *CreateTokenInstanceCreateNewToken creates an instance of Token override. Call .Do(ctx) on the
instance to actually create new token. Default value for instance follows vault
token documentation, on here:
https://www.vaultproject.io/api/auth/token#parameters
Which means the new token will be renewable by default and has display name of 'token'
func (v *Vault) GetConfig(ctx context.Context, path string) (data []byte, err error)GetConfig returns config from vault. The path format is '/{secret engine name}/{secret name}'
Example: data, err := vault.GetConfig(context.Background(), "/kv/foo")
func (v *Vault) GetConfigLoad(ctx context.Context, path string, model interface{}) (err error)GetConfigLoad returns config and loaded into a variable The path format is '/{secret engine name}/{secret name}'
func (v *Vault) GetKeyValue(ctx context.Context, key string) (data []byte, err error)GetKeyValue returns key value store from vault. 'Key' is the key name. Like for example 'ms-order-conf'
func (v *Vault) GetKeyValueLoad(ctx context.Context, key string, model interface{}) (err error)GetKeyValueLoad returns config and loaded into a variable 'Key' is the key name. Like for example 'ms-order-conf'
func (v *Vault) LookupOther(ctx context.Context, token string) (lookup LookupToken, err error)LookupOther lookup information on passed token
func (v *Vault) LookupSelf(ctx context.Context) (lookup LookupToken, err error)LookupSelf lookup information on current token used in the instance
func (v *Vault) RenewTokenOther(ctx context.Context, token string) (err error)RenewTokenOther attempts to renew passed token using self's token
func (v *Vault) RenewTokenOverride(ctx context.Context, token string) (err error)RenewTokenOverride attempts to renew passed token with passed token as auth
func (v *Vault) RenewTokenSelf(ctx context.Context) (err error)RenewTokenSelf attempts to renew token registered to self. Cannot renew root token with 0 time to live (never expire).
func (v *Vault) TransitDecrypt(ctx context.Context, key, cipherText string) (data []byte, err error)TransitDecrypt decrypts a transit encrypted payload. If decyprting a big ciphertext like if decrypted it's actually an image, please use TransitDecryptStream.
func (v *Vault) TransitDecryptStream(ctx context.Context, key string, cipher io.Reader) (payload io.Reader, err error)TransitDecryptStream decrypts a transit encrypted payload in streaming manner. Best usage is if you expect a big ciphertext from whatever your source is.
func (v *Vault) TransitEncrypt(ctx context.Context, key string, payload []byte) (cipherText string, err error)TransitEncrypt will encrypt payload for sending somewhere else. 'key' is the encryptor name.
func (v *Vault) TransitEncryptStream(ctx context.Context, key string, payload io.Reader) (io.Reader, error)TransitEncryptStream will encrypt payload in stream manner to prevent memory overload on huge number of operation. Use this function for big files. The returned io Reader is a stream of pure encoded vault data without bells and whistles of JSON.
func (v *Vault) UpsertPolicy(ctx context.Context, policy string, permissions map[string][]Capability) (err error)UpsertPolicy creates/updates a policy. Token used in the instance must have the permission to even update policy itself. Root token have all permissions