Skip to content

Latest commit

 

History

History
86 lines (63 loc) · 6.74 KB

README.md

File metadata and controls

86 lines (63 loc) · 6.74 KB

Secret rotator

Badges

Build Status License Release GitHub Releases Stats of secret-rotator

Maintainability codecov Go Report Card

Run locally

To run the code locally, you can use the makefile:

# load env vars from file
export $(cat .env | xargs) 2>&1 > /dev/null
# build code
$ make build
# build & run
$ make run

Configuration is retrieved from secretrotator.yaml by default. (See structure below) Path can be configured from the env var SECRETROTATOR_CONFIG_PATH. You can take example from the secretrotator.example.yaml file or from the configuration file in test/

.env contains the secrets used to connect to the multiple backends. (See .env.example and the configuration section below)

Run with docker

To run the code with docker, you can use the makefile:

# build & run with docker-compose
$ make docker-compose

As for the local mode, you'll need to fill the secretrotator.yaml configuration file and the .env file.

Configuration

input required default supported value description
env False prod any string Environment, used to configure logger format.
logLevel False info trace/debug/info/warn/error Log level for the logger.
providers.<id> True N/A any string Arbitrary ID, used to match configuration in the secrets section.
providers.<id>.type True N/A gitlab/gcp Backend use either as a secret source or a secret destination.
providers.<id>.repoUrl False "" any string URL used to communicate with the backend API. Not used for GCP.
providers.<id>.apiToken True "" any string Token used to communicate with the backend API. Needs to be set to "" to be overrides by env vars. Not used for GCP.
secrets.name True N/A Arbitrary ame of the secret rotation operation.
secrets[].source.id True N/A any string Must match the ID of a previously declared provider.
secrets[].source.type True N/A gcp_sa Source type to read the secret.
secrets[].source.path True N/A any string Path where to read the secret: GCP projectId.
secrets[].source.secretName True N/A any string Secret name: GCP SA email.
secrets[].source.options.nbMaxConcurrent False 2 any int Max number of versions of the secret to keep.
secrets[].dest[].id True N/A any int Must match the ID of a previously declared provider.
secrets[].dest[].type True N/A gitlab_project Source type to write the secret.
secrets[].dest[].path True N/A any int Path where to write the secret: GitLab repo path.
secrets[].dest[].secretName True N/A any int Secret name: GitLab CI variable key.
secrets[].dest[].options.base64 False false any int Enables or disables base64 encoding of secrets.

Every non array option has a corresponding environment variable. For example providers.gitlab.type corresponds to SECRETROTATOR_PROVIDERS_GITLAB_TYPE. When using env vars, corresponding configuration must be set to "" in the config file so that the variable is evaluated.

Development

Run the tests

Fill .env secret in test/

$ make test

Run quality

$ make quality