class Hiera::Backend::Eyaml::Encryptors::Gkms

Google KMS plugin for hiera-eyaml

Constants

VERSION

Public Class Methods

decrypt(ciphertext) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/gkms.rb, line 89
def self.decrypt(ciphertext)
  kms_client.decrypt(name: key_path, ciphertext: ciphertext).plaintext
end
encrypt(plaintext) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/gkms.rb, line 85
def self.encrypt(plaintext)
  kms_client.encrypt(name: key_path, plaintext: plaintext).ciphertext
end
key_path() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/gkms.rb, line 69
def self.key_path
  project = option :project
  location = option :location
  key_ring = option :keyring
  crypto_key = option :crypto_key

  raise StandardError, 'gkms_project is not defined' unless project
  raise StandardError, 'gkms_keyring is not defined' unless key_ring
  raise StandardError, 'gkms_crypto_key is not defined' unless crypto_key

  kms_client.crypto_key_path project: project,
                             location: location,
                             key_ring: key_ring,
                             crypto_key: crypto_key
end
kms_client() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/gkms.rb, line 52
def self.kms_client
  auth_type = option :auth_type

  if auth_type == 'serviceaccount'
    credentials = option :credentials
    raise StandardError, 'gkms_credentials is not defined' unless credentials

    ::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
      config.credentials = credentials
    end
  else
    ENV['GOOGLE_AUTH_SUPPRESS_CREDENTIALS_WARNINGS'] = '1'
  end

  ::Google::Cloud::Kms::V1::KeyManagementService::Client.new
end