syntax = "proto3";

package envoy.extensions.formatter.generic_secret.v3;

import "envoy/extensions/transport_sockets/tls/v3/secret.proto";

import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.formatter.generic_secret.v3";
option java_outer_classname = "GenericSecretProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/formatter/generic_secret/v3;generic_secretv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: Formatter extension for printing values from generic secrets]
// [#extension: envoy.formatter.generic_secret]

// GenericSecret formatter extension implements the ``%SECRET(name)%`` command operator that
// resolves the value of a named generic secret obtained via SDS or static bootstrap configuration.
//
// The secret must be a :ref:`GenericSecret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.GenericSecret>`
// with the ``secret`` field set.
//
// Example configuration adding an authorization header with a secret obtained via SDS:
//
// .. code-block:: yaml
//
//   http_uri:
//     uri: https://api.example.com/v1/data
//     cluster: api_backend
//     timeout: 5s
//   request_headers_to_add:
//   - header:
//       key: "authorization"
//       value: "Bearer %SECRET(my-api-token)%"
//   formatters:
//   - name: envoy.formatter.generic_secret
//     typed_config:
//       "@type": type.googleapis.com/envoy.extensions.formatter.generic_secret.v3.GenericSecret
//       secret_configs:
//         my-api-token:
//           name: bearer-token
//           sds_config:
//             ads: {}
message GenericSecret {
  // Map from formatter lookup name to SDS secret configuration. The map key is the name used
  // in the ``%SECRET(name)%`` command operator.
  map<string, transport_sockets.tls.v3.SdsSecretConfig> secret_configs = 1
      [(validate.rules).map = {min_pairs: 1}];
}
