Skip to content

Commit 14364fc

Browse files
committed
add support to Google Secret Manager
1 parent ee34fae commit 14364fc

File tree

9 files changed

+517
-84
lines changed

9 files changed

+517
-84
lines changed

.gitignore

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,23 @@
1+
# code coverage
2+
.cover
3+
4+
# git repo
5+
.git
6+
7+
# IDE customization
8+
.idea
19
.vscode
210

3-
# ignore binary
4-
secrets-init
11+
# binaries
12+
.bin
13+
14+
# env customization
15+
.env
16+
17+
# goreleaser binaries
18+
dist
519

6-
# ignore goreleaser binaries
7-
dist/
20+
# temporary
21+
**/.DS_Store
22+
**/debug
23+
**/debug.test

Makefile

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
MODULE = $(shell env GO111MODULE=on $(GO) list -m)
2+
DATE ?= $(shell date +%FT%T%z)
3+
VERSION ?= $(shell git describe --tags --always --dirty --match="v*" 2> /dev/null || \
4+
cat $(CURDIR)/.version 2> /dev/null || echo v0)
5+
PKGS = $(or $(PKG),$(shell env GO111MODULE=on $(GO) list ./...))
6+
TESTPKGS = $(shell env GO111MODULE=on $(GO) list -f \
7+
'{{ if or .TestGoFiles .XTestGoFiles }}{{ .ImportPath }}{{ end }}' \
8+
$(PKGS))
9+
BIN = $(CURDIR)/.bin
10+
11+
GO = go
12+
TIMEOUT = 15
13+
V = 0
14+
Q = $(if $(filter 1,$V),,@)
15+
M = $(shell printf "\033[34;1m▶\033[0m")
16+
17+
export GO111MODULE=on
18+
export CGO_ENABLED=0
19+
export GOPROXY=https://proxy.golang.org
20+
21+
.PHONY: all
22+
all: fmt lint | $(BIN) ; $(info $(M) building executable…) @ ## Build program binary
23+
$Q $(GO) build \
24+
-tags release \
25+
-ldflags '-X main.Version=$(VERSION) -X main.BuildDate=$(DATE)' \
26+
-o $(BIN)/$(basename $(MODULE)) main.go
27+
28+
# Tools
29+
30+
$(BIN):
31+
@mkdir -p $@
32+
$(BIN)/%: | $(BIN) ; $(info $(M) building $(PACKAGE)…)
33+
$Q tmp=$$(mktemp -d); \
34+
env GO111MODULE=off GOPATH=$$tmp GOBIN=$(BIN) $(GO) get $(PACKAGE) \
35+
|| ret=$$?; \
36+
rm -rf $$tmp ; exit $$ret
37+
38+
GOLINT = $(BIN)/golint
39+
$(BIN)/golint: PACKAGE=golang.org/x/lint/golint
40+
41+
GOCOV = $(BIN)/gocov
42+
$(BIN)/gocov: PACKAGE=github.com/axw/gocov/...
43+
44+
GOCOVXML = $(BIN)/gocov-xml
45+
$(BIN)/gocov-xml: PACKAGE=github.com/AlekSi/gocov-xml
46+
47+
GO2XUNIT = $(BIN)/go2xunit
48+
$(BIN)/go2xunit: PACKAGE=github.com/tebeka/go2xunit
49+
50+
# Tests
51+
52+
TEST_TARGETS := test-default test-bench test-short test-verbose test-race
53+
.PHONY: $(TEST_TARGETS) test-xml check test tests
54+
test-bench: ARGS=-run=__absolutelynothing__ -bench=. ## Run benchmarks
55+
test-short: ARGS=-short ## Run only short tests
56+
test-verbose: ARGS=-v ## Run tests in verbose mode with coverage reporting
57+
test-race: ARGS=-race ## Run tests with race detector
58+
$(TEST_TARGETS): NAME=$(MAKECMDGOALS:test-%=%)
59+
$(TEST_TARGETS): test
60+
check test tests: fmt lint ; $(info $(M) running $(NAME:%=% )tests…) @ ## Run tests
61+
$Q $(GO) test -timeout $(TIMEOUT)s $(ARGS) $(TESTPKGS)
62+
63+
test-xml: fmt lint | $(GO2XUNIT) ; $(info $(M) running xUnit tests…) @ ## Run tests with xUnit output
64+
$Q mkdir -p test
65+
$Q 2>&1 $(GO) test -timeout $(TIMEOUT)s -v $(TESTPKGS) | tee test/tests.output
66+
$(GO2XUNIT) -fail -input test/tests.output -output test/tests.xml
67+
68+
COVERAGE_MODE = atomic
69+
COVERAGE_PROFILE = $(COVERAGE_DIR)/profile.out
70+
COVERAGE_XML = $(COVERAGE_DIR)/coverage.xml
71+
COVERAGE_HTML = $(COVERAGE_DIR)/index.html
72+
.PHONY: test-coverage test-coverage-tools
73+
test-coverage-tools: | $(GOCOV) $(GOCOVXML)
74+
test-coverage: COVERAGE_DIR := $(CURDIR)/test/coverage.$(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
75+
test-coverage: fmt lint test-coverage-tools ; $(info $(M) running coverage tests…) @ ## Run coverage tests
76+
$Q mkdir -p $(COVERAGE_DIR)
77+
$Q $(GO) test \
78+
-coverpkg=$$($(GO) list -f '{{ join .Deps "\n" }}' $(TESTPKGS) | \
79+
grep '^$(MODULE)/' | \
80+
tr '\n' ',' | sed 's/,$$//') \
81+
-covermode=$(COVERAGE_MODE) \
82+
-coverprofile="$(COVERAGE_PROFILE)" $(TESTPKGS)
83+
$Q $(GO) tool cover -html=$(COVERAGE_PROFILE) -o $(COVERAGE_HTML)
84+
$Q $(GOCOV) convert $(COVERAGE_PROFILE) | $(GOCOVXML) > $(COVERAGE_XML)
85+
86+
.PHONY: lint
87+
lint: | $(GOLINT) ; $(info $(M) running golint…) @ ## Run golint
88+
$Q $(GOLINT) -set_exit_status $(PKGS)
89+
90+
.PHONY: fmt
91+
fmt: ; $(info $(M) running gofmt…) @ ## Run gofmt on all source files
92+
$Q $(GO) fmt $(PKGS)
93+
94+
# Misc
95+
96+
.PHONY: clean
97+
clean: ; $(info $(M) cleaning…) @ ## Cleanup everything
98+
@rm -rf $(BIN)
99+
@rm -rf test/tests.* test/coverage.*
100+
101+
.PHONY: help
102+
help:
103+
@grep -E '^[ a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
104+
awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-15s\033[0m %s\n", $$1, $$2}'
105+
106+
.PHONY: version
107+
version:
108+
@echo $(VERSION)

README.md

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@
44

55
# secrets-init
66

7-
`secrets-init` is a minimalistic init system designed to run as PID 1 inside container environments, similar to [dumb-init](https://github.com/Yelp/dumb-init), integrated with [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) and [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) services.
7+
`secrets-init` is a minimalistic init system designed to run as PID 1 inside container environments, similar to [dumb-init](https://github.com/Yelp/dumb-init), integrated with multiple secrets manager services:
8+
9+
- [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)
10+
- [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
11+
- [Google Secret Manager](https://cloud.google.com/secret-manager/docs/)
812

913
## Why you need an init system
1014

@@ -23,7 +27,7 @@ Summary:
2327

2428
### Integration with AWS Secrets Manager
2529

26-
User can put AWS secret ARN as environment variable value. The `secrets-manager` will resolve any environment value, using specified ARN, to referenced secret value.
30+
User can put AWS secret ARN as environment variable value. The `secrets-init` will resolve any environment value, using specified ARN, to referenced secret value.
2731

2832
```sh
2933
# environment variable passed to `secrets-init`
@@ -37,7 +41,7 @@ MY_DB_PASSWORD=very-secret-password
3741

3842
It is possible to use AWS Systems Manager Parameter Store to store application parameters and secrets.
3943

40-
User can put AWS Parameter Store ARN as environment variable value. The `secrets-manager` will resolve any environment value, using specified ARN, to referenced parameter value.
44+
User can put AWS Parameter Store ARN as environment variable value. The `secrets-init` will resolve any environment value, using specified ARN, to referenced parameter value.
4145

4246
```sh
4347
# environment variable passed to `secrets-init`
@@ -47,6 +51,20 @@ MY_API_KEY=arn:aws:ssm:$AWS_REGION:$AWS_ACCOUNT_ID:parameter/api/key
4751
MY_API_KEY=key-123456789
4852
```
4953

54+
### Integration with Google Secret Manager
55+
56+
User can put Google secret name (prefixed with `gcp:secretmanager:`) as environment variable value. The `secrets-init` will resolve any environment value, using specified name, to referenced secret value.
57+
58+
```sh
59+
# environment variable passed to `secrets-init`
60+
MY_DB_PASSWORD=gcp:secretmanager:projects/$PROJECT_ID/secrets/mydbpassword
61+
# OR versioned secret (with version or 'latest')
62+
MY_DB_PASSWORD=gcp:secretmanager:projects/$PROJECT_ID/secrets/mydbpassword/versions/2
63+
64+
# environment variable passed to child process, resolved by `secrets-init`
65+
MY_DB_PASSWORD=very-secret-password
66+
```
67+
5068
### Requirement
5169

5270
In order to resolve AWS secrets from AWS Secret Manager and Parameter Store, `secrets-init` should run under IAM role that has permission to access desired secrets.

go.mod

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,12 @@ module secrets-init
33
go 1.13
44

55
require (
6+
cloud.google.com/go v0.50.0
67
github.com/aws/aws-sdk-go v1.24.1
8+
github.com/sirupsen/logrus v1.4.2
79
github.com/stretchr/testify v1.4.0 // indirect
10+
github.com/urfave/cli/v2 v2.0.0
811
golang.org/x/net v0.0.0-20190918130420-a8b05e9114ab // indirect
12+
google.golang.org/api v0.15.0 // indirect
13+
google.golang.org/genproto v0.0.0-20191220175831-5c49e3ecc1c1
914
)

0 commit comments

Comments
 (0)