Skip to content

Commit cdc74ca

Browse files
edimarlnxedimarlnx
committed
Add support for OCI Vault as a secret engine
Integrated Oracle Cloud Infrastructure (OCI) Vault as a new pluggable secret engine. Updated README, configuration options, connectors, and tests to support features like secret fetching, writing, and template rendering.
1 parent e8a126b commit cdc74ca

11 files changed

Lines changed: 511 additions & 19 deletions

File tree

‎CLAUDE.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ pkg/
1919
connector.go # Connector interface (Init, Secret, WriteKey, WriteKeys, Finalize, ConnectorType)
2020
vault.go # HashiCorp Vault KVv2 connector
2121
local-file.go # Local file connector with RSA encryption (OAEP + SHA256)
22+
oci-vault.go # OCI Vault connector (Oracle Cloud Infrastructure)
2223
no-connector.go # No-op connector (used when no config is provided)
2324
print-keys.go # Collects template key references (for --print-keys flag)
2425
envs/envs.go # Environment variable name constants
@@ -32,9 +33,9 @@ pkg/
3233
## Key Concepts
3334

3435
- **Connector interface**: All secret engines implement `connectors.Connector`. Factory: `connectors.NewConnector()`.
35-
- **Secret engines**: `vault`, `local-file`, `no` (no-op), `print-keys` (introspection).
36+
- **Secret engines**: `vault`, `local-file`, `oci-vault`, `no` (no-op), `print-keys` (introspection).
3637
- **Template functions**: `secret "name" "key"`, `env "VAR_NAME"`, all [sprig](https://masterminds.github.io/sprig/) functions.
37-
- **Config file**: JSON with `secret_engine`, `vault_config`, `local_file_config`, and `options` fields.
38+
- **Config file**: JSON with `secret_engine`, `vault_config`, `local_file_config`, `oci_vault_config`, and `options` fields.
3839

3940
## Commands
4041

@@ -58,6 +59,11 @@ pkg/
5859
| `VAULT_NS` | Vault namespace |
5960
| `LOCAL_SECRET_PRIVATE_KEY` | Base64-encoded RSA private key |
6061
| `LOCAL_SECRET_PRIVATE_KEY_PASSPHRASE` | Passphrase for RSA key |
62+
| `OCI_CONFIG_FILE` | Path to OCI config file (default: `~/.oci/config`) |
63+
| `OCI_CONFIG_PROFILE` | OCI config profile (default: `DEFAULT`) |
64+
| `OCI_VAULT_OCID` | OCI Vault OCID |
65+
| `OCI_COMPARTMENT_OCID` | OCI Compartment OCID (required for write operations) |
66+
| `OCI_KEY_OCID` | OCI Master Encryption Key OCID (required for write operations) |
6167

6268
## Build & Run
6369

@@ -112,4 +118,5 @@ goreleaser release --clean
112118
| `Masterminds/sprig/v3` | Template function library |
113119
| `joho/godotenv` | .env file parsing |
114120
| `go-jose/go-jose/v3` | JSON serialization (used in local-file connector) |
115-
| `sirupsen/logrus` | Structured logging |
121+
| `sirupsen/logrus` | Structured logging |
122+
| `oracle/oci-go-sdk/v65` | OCI SDK (Vault, Secrets clients) |

‎README.md‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ A CLI tool that renders [Go templates](https://pkg.go.dev/text/template) with se
99
## Features
1010

1111
- Render any text file using Go template syntax with secret injection
12-
- Pluggable secret engines: HashiCorp Vault, local encrypted file, or no-op
12+
- Pluggable secret engines: HashiCorp Vault, OCI Vault, local encrypted file, or no-op
1313
- Built-in [sprig](https://masterminds.github.io/sprig/) template functions (100+ utility functions)
1414
- Custom template delimiters to avoid conflicts with Helm, Jinja, etc.
1515
- Environment variable support in templates and config values
@@ -187,6 +187,28 @@ Uses the [Vault KVv2](https://www.vaultproject.io/) secret engine.
187187

188188
For local development, a Docker Compose setup is available in [`dev/vault/`](dev/vault/README.md).
189189

190+
### OCI Vault
191+
192+
Uses [Oracle Cloud Infrastructure Vault](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keyoverview.htm) as the secret engine. Each OCI secret stores a single value (native key-value model).
193+
194+
In templates, the first parameter is the **vault name** and the second is the **secret name**:
195+
196+
```
197+
{{ secret "my-vault" "db_password" }}
198+
```
199+
200+
This allows accessing secrets from multiple vaults in a single template. The vault is resolved by display name within the configured compartment.
201+
202+
For single-arg calls (`{{ secret "db_password" }}`), the default vault OCID from config/env is used.
203+
204+
| Env var | Description |
205+
|---------|-------------|
206+
| `OCI_CONFIG_FILE` | Path to OCI config file (default: `~/.oci/config`) |
207+
| `OCI_CONFIG_PROFILE` | OCI config profile (default: `DEFAULT`) |
208+
| `OCI_VAULT_OCID` | Default OCI Vault OCID (optional, used for single-arg secret calls) |
209+
| `OCI_COMPARTMENT_OCID` | OCI Compartment OCID (required for vault name resolution and write operations) |
210+
| `OCI_KEY_OCID` | OCI Master Encryption Key OCID (required for write operations) |
211+
190212
### Local File
191213

192214
Stores secrets in a local JSON file encrypted with RSA (OAEP + SHA256).
@@ -211,6 +233,11 @@ Stores secrets in a local JSON file encrypted with RSA (OAEP + SHA256).
211233
"filename": "secrets.json",
212234
"enc_priv_key": "LS0tLS...."
213235
},
236+
"oci_vault_config": {
237+
"vault_ocid": "$OCI_VAULT_OCID",
238+
"compartment_ocid": "$OCI_COMPARTMENT_OCID",
239+
"key_ocid": "$OCI_KEY_OCID"
240+
},
214241
"options": {
215242
"secretShowNameAsValueIfEmpty": false,
216243
"secretIgnoreNotFoundKey": false,

‎go.mod‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
11
module github.com/zcloud-ws/secure-templates
22

3-
go 1.21.9
3+
go 1.24.0
44

55
require (
66
github.com/Masterminds/sprig/v3 v3.2.3
77
github.com/go-jose/go-jose/v3 v3.0.3
88
github.com/hashicorp/vault/api v1.12.0
99
github.com/joho/godotenv v1.5.1
10+
github.com/oracle/oci-go-sdk/v65 v65.108.2
11+
github.com/sirupsen/logrus v1.9.3
1012
github.com/urfave/cli/v2 v2.27.1
1113
)
1214

@@ -15,6 +17,7 @@ require (
1517
github.com/Masterminds/semver/v3 v3.2.0 // indirect
1618
github.com/cenkalti/backoff/v3 v3.0.0 // indirect
1719
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
20+
github.com/gofrs/flock v0.10.0 // indirect
1821
github.com/google/uuid v1.1.1 // indirect
1922
github.com/hashicorp/errwrap v1.1.0 // indirect
2023
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -34,12 +37,13 @@ require (
3437
github.com/russross/blackfriday/v2 v2.1.0 // indirect
3538
github.com/ryanuber/go-glob v1.0.0 // indirect
3639
github.com/shopspring/decimal v1.2.0 // indirect
37-
github.com/sirupsen/logrus v1.9.3 // indirect
40+
github.com/sony/gobreaker v0.5.0 // indirect
3841
github.com/spf13/cast v1.3.1 // indirect
3942
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
40-
golang.org/x/crypto v0.21.0 // indirect
41-
golang.org/x/net v0.23.0 // indirect
42-
golang.org/x/sys v0.18.0 // indirect
43-
golang.org/x/text v0.14.0 // indirect
43+
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
44+
golang.org/x/crypto v0.45.0 // indirect
45+
golang.org/x/net v0.47.0 // indirect
46+
golang.org/x/sys v0.38.0 // indirect
47+
golang.org/x/text v0.31.0 // indirect
4448
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 // indirect
4549
)

‎go.sum‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7
1919
github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
2020
github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
2121
github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
22+
github.com/gofrs/flock v0.10.0 h1:SHMXenfaB03KbroETaCMtbBg3Yn29v4w1r+tgy4ff4k=
23+
github.com/gofrs/flock v0.10.0/go.mod h1:FirDy1Ing0mI2+kB6wk+vyyAH+e6xiE+EYA0jnzV9jc=
2224
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
2325
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
2426
github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
@@ -73,6 +75,8 @@ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyua
7375
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
7476
github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
7577
github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
78+
github.com/oracle/oci-go-sdk/v65 v65.108.2 h1:emoGAxw/vcqoKHgUy6a10RIhAQbaDPQPiuIcoZuoJGw=
79+
github.com/oracle/oci-go-sdk/v65 v65.108.2/go.mod h1:8ZzvzuEG/cFLFZhxg/Mg1w19KqyXBKO3c17QIc5PkGs=
7680
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
7781
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
7882
github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
@@ -85,25 +89,32 @@ github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXY
8589
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
8690
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
8791
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
92+
github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
93+
github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
8894
github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
8995
github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
9096
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
97+
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
98+
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
9199
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
100+
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
92101
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
93102
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
94-
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
95-
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
103+
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
104+
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
96105
github.com/urfave/cli/v2 v2.27.1 h1:8xSQ6szndafKVRmfyeUMxkNUJQMjL1F2zmsZ+qHpfho=
97106
github.com/urfave/cli/v2 v2.27.1/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
98107
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
99108
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
109+
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
110+
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
100111
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
101112
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
102113
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
103114
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
104115
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
105-
golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
106-
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
116+
golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
117+
golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
107118
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
108119
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
109120
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -112,8 +123,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
112123
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
113124
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
114125
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
115-
golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
116-
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
126+
golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
127+
golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
117128
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
118129
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
119130
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -128,8 +139,8 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
128139
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
129140
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
130141
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
131-
golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
132-
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
142+
golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
143+
golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
133144
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
134145
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
135146
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -142,8 +153,9 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
142153
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
143154
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
144155
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
145-
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
146156
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
157+
golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
158+
golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
147159
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
148160
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
149161
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎pkg/config/config.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ const (
1414
SecretEngineLocalFile SecretEngine = "local-file"
1515
SecretEnginePrintKeys SecretEngine = "print-keys"
1616
SecretEngineNo SecretEngine = "no"
17+
SecretEngineOCIVault SecretEngine = "oci-vault"
1718
//SecretEngineOnePassword SecretEngine = "one-password"
1819
)
1920

@@ -32,6 +33,7 @@ type SecureTemplateConfig struct {
3233
VaultConfig VaultConfig `json:"vault_config,omitempty"`
3334
//OnePasswordConfig OnePasswordConfig `json:"one_password_config,omitempty"`
3435
LocalFileConfig LocalFileConfig `json:"local_file_config,omitempty"`
36+
OCIVaultConfig OCIVaultConfig `json:"oci_vault_config,omitempty"`
3537
Options SecureTemplateConfigOptions `json:"options"`
3638
}
3739

@@ -51,6 +53,14 @@ type LocalFileConfig struct {
5153
Passphrase string `json:"passphrase,omitempty"`
5254
}
5355

56+
type OCIVaultConfig struct {
57+
ConfigFile string `json:"config_file,omitempty"`
58+
Profile string `json:"profile,omitempty"`
59+
VaultOCID string `json:"vault_ocid,omitempty"`
60+
CompartmentOCID string `json:"compartment_ocid,omitempty"`
61+
KeyOCID string `json:"key_ocid,omitempty"`
62+
}
63+
5464
func (cfg *SecureTemplateConfig) Json(out io.Writer) error {
5565
data, err := json.MarshalIndent(cfg, "", " ")
5666
if err != nil {
@@ -63,6 +73,7 @@ func (cfg *SecureTemplateConfig) Json(out io.Writer) error {
6373
func (cfg *SecureTemplateConfig) ExpandEnvVars() {
6474
cfg.VaultConfig.expandEnvVars()
6575
cfg.LocalFileConfig.expandEnvVars()
76+
cfg.OCIVaultConfig.expandEnvVars()
6677
}
6778

6879
func (vCfg *VaultConfig) expandEnvVars() {
@@ -78,6 +89,14 @@ func (lCfg *LocalFileConfig) expandEnvVars() {
7889
lCfg.Passphrase = expandEnvironmentVariables(lCfg.Passphrase)
7990
}
8091

92+
func (oCfg *OCIVaultConfig) expandEnvVars() {
93+
oCfg.ConfigFile = expandEnvironmentVariables(oCfg.ConfigFile)
94+
oCfg.Profile = expandEnvironmentVariables(oCfg.Profile)
95+
oCfg.VaultOCID = expandEnvironmentVariables(oCfg.VaultOCID)
96+
oCfg.CompartmentOCID = expandEnvironmentVariables(oCfg.CompartmentOCID)
97+
oCfg.KeyOCID = expandEnvironmentVariables(oCfg.KeyOCID)
98+
}
99+
81100
func expandEnvironmentVariables(env string) string {
82101
if env == "" || !strings.Contains(env, "$") {
83102
return env

‎pkg/connectors/connector.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ func NewConnector(secTplConfig config.SecureTemplateConfig) Connector {
2525
connector = &PrintKeysConnector{}
2626
case config.SecretEngineNo:
2727
connector = &NoConnector{}
28+
case config.SecretEngineOCIVault:
29+
connector = &OCIVaultConnector{}
2830
default:
2931
logging.Log.Fatalf("Connector not implemented: %s\n", secTplConfig.SecretEngine)
3032
return nil

0 commit comments

Comments
 (0)