resolveVaultToken resolves the Vault token from the external secret config. The token field is interpreted according to TokenType: the literal token (PLAIN), an environment variable name (ENVIRONMENT), or a file path (FILE). Both env var and file are resolved on the Bytebase server host.
(externalSecret *storepb.DataSourceExternalSecret)
| 121 | // (PLAIN), an environment variable name (ENVIRONMENT), or a file path (FILE). |
| 122 | // Both env var and file are resolved on the Bytebase server host. |
| 123 | func resolveVaultToken(externalSecret *storepb.DataSourceExternalSecret) (string, error) { |
| 124 | value := externalSecret.GetToken() |
| 125 | switch externalSecret.GetTokenType() { |
| 126 | case storepb.DataSourceExternalSecret_ENVIRONMENT: |
| 127 | token := os.Getenv(value) |
| 128 | if token == "" { |
| 129 | return "", errors.Errorf("vault token environment variable %q is empty or unset", value) |
| 130 | } |
| 131 | return token, nil |
| 132 | case storepb.DataSourceExternalSecret_FILE: |
| 133 | b, err := os.ReadFile(value) |
| 134 | if err != nil { |
| 135 | return "", errors.Wrapf(err, "failed to read vault token file %q", value) |
| 136 | } |
| 137 | token := strings.TrimSpace(string(b)) |
| 138 | if token == "" { |
| 139 | return "", errors.Errorf("vault token file %q is empty", value) |
| 140 | } |
| 141 | return token, nil |
| 142 | default: |
| 143 | // PLAIN or unspecified (backward compatibility). |
| 144 | return value, nil |
| 145 | } |
| 146 | } |
| 147 | |
| 148 | func getSecretFromVault(ctx context.Context, externalSecret *storepb.DataSourceExternalSecret) (string, error) { |
| 149 | client, err := getVaultClient(ctx, externalSecret) |