Azure

Azure Key Vault, built on the azsecrets SDK.

Install

go get github.com/xavidop/mamori/providers/azure

import _ "github.com/xavidop/mamori/providers/azure"

Using the ref

An azure-kv:// ref points at one secret in an Azure Key Vault, at a specific (or the latest) version.

azure-kv://<vault-name>/<secret-name>[#json-key][?version=<v>]

Examples

• azure-kv://my-vault/db-password reads the latest version of db-password.
• azure-kv://my-vault/api-key?version=abc123 pins the abc123 version.
• azure-kv://my-vault/creds#password selects the password field of a JSON secret.

type Config struct {
	DBPassword secret.String `source:"azure-kv://my-vault/db-password"`
	APIKey     secret.String `source:"azure-kv://my-vault/api-key?version=abc123"`
	Nested     secret.String `source:"azure-kv://my-vault/creds#password"`
}

Values are always Sensitive, and Value.Version is the secret’s version id (a content hash if unavailable).

Explicit configuration

Authentication uses DefaultAzureCredential (environment, managed identity, Azure CLI, …). Inject a credential or client explicitly for tests or non-default auth:

import azureprov "github.com/xavidop/mamori/providers/azure"

mamori.WithProvider(azureprov.New(azureprov.WithCredential(myCred)))

Watch

Key Vault has no native change notification, so mamori polls (WithPollInterval + jitter).

Error classification

This table is classifyAzure, one function shared with azure-appconfig:// in this same module - App Configuration returns the same HTTP statuses as Key Vault, so nothing in this table is specific to secrets.

A transport failure (no HTTP response at all) stays unknown, since it could be a client problem rather than a backend one. *azcore.ResponseError stays reachable with errors.As.

Verified by unit tests and the conformance kit against an in-memory fake; live Azure behavior is covered by //go:build integration tests.