Function NewManager

pkg/credentials/vault/keyval.go:61–103

NewManager creates a new credentials manager that uses Hashicorp Vault as backend Configured to write secrets in the KVv2 engine referenced by the provided mount path. SecretPrefix is used to namespace secrets in the KVv2 engine during write operations.

(opts *NewManagerOpts)

// Configured to write secrets in the KVv2 engine referenced by the provided mount path.
// SecretPrefix is used to namespace secrets in the KVv2 engine during write operations.
func NewManager(opts *NewManagerOpts) (*Manager, error) {
	if opts.AuthToken == "" || opts.Address == "" {
		return nil, errors.New("auth token and instance address are required")
	}

	config := vault.DefaultConfig()
	config.Address = opts.Address
	config.Timeout = 1 * time.Second

	client, err := vault.NewClient(config)
	if err != nil {
		return nil, err
	}

	client.SetToken(opts.AuthToken)

	mountPath := defaultKVMountPath
	if opts.MountPath != "" {
		mountPath = opts.MountPath
	}

	l := opts.Logger
	if l == nil {
		l = log.NewStdLogger(io.Discard)
	}

	logger := servicelogger.ScopedHelper(l, "credentials/vault")
	logger.Infow("msg", "configuring vault", "address", opts.Address, "mount_path", mountPath, "prefix", opts.SecretPrefix, "role", opts.Role)

	// Check address, token validity and mount path
	kv := client.KVv2(mountPath)
	if opts.Role == credentials.RoleReader {
		if err := validateReaderClient(kv, opts.SecretPrefix); err != nil {
			return nil, fmt.Errorf("validating client: %w", err)
		}
	} else {
		if err := validateWriterClient(kv, opts.SecretPrefix); err != nil {
			return nil, fmt.Errorf("validating client: %w", err)
		}
	}

	return &Manager{kv, opts.SecretPrefix, logger}, nil
}

// validateWriterClient checks if the client is valid by writing and deleting a secret
// in the provided mount path.