// NewVault initializes Hashicorp Vault KMS by authenticating
// to Vault with the credentials in config and gets a client
// token for future api calls.
542534
func NewVault(config VaultConfig) (KMS, error) {
	if config.IsEmpty() {
		return nil, errors.New("crypto: the hashicorp vault configuration must not be empty")
	}
	if err := config.Verify(); err != nil {
		return nil, err
	}

	vaultCfg := vault.Config{Address: config.Endpoint}
	if err := vaultCfg.ConfigureTLS(&vault.TLSConfig{CAPath: config.CAPath}); err != nil {
		return nil, err
	}
	client, err := vault.NewClient(&vaultCfg)
	if err != nil {
		return nil, err
	}
	if config.Namespace != "" {
		client.SetNamespace(config.Namespace)
	}
	v := &vaultService{client: client, config: &config}
	if err := v.authenticate(); err != nil {
		return nil, err
	}
	v.renewToken()
	return v, nil
}
1365766
func NewVPCClient(accessKeyId string, accessKeySecret string, regionID common.Region) *Client {
	return NewVPCClientWithSecurityToken(accessKeyId, accessKeySecret, "", regionID)
}
1340433
func NewOASDocument() *OASDocument {
	return &OASDocument{
		Version: OASVersion,
		Info: OASInfo{
			Title:       "HashiCorp Vault API",
			Description: "HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.",
			Version:     version.GetVersion().Version,
			License: OASLicense{
				Name: "Mozilla Public License 2.0",
				URL:  "https://www.mozilla.org/en-US/MPL/2.0",
			},
		},
		Paths: make(map[string]*OASPathItem),
	}
}
617397
func (s *Server) setupVaultClient() error {
	v, err := NewVaultClient(s.config.VaultConfig, s.logger, s.purgeVaultAccessors)
	if err != nil {
		return err
	}
	s.vault = v
	return nil
}
905879
func NewConsul(u *url.URL) (*LibKV, error) {
	consul.Register()
	c, err := consulURL(u)
	if err != nil {
		return nil, err
	}
	config, err := consulConfig(c.Scheme == https)
	if err != nil {
		return nil, err
	}
	if role := env.Getenv("CONSUL_VAULT_ROLE", ""); role != "" {
		mount := env.Getenv("CONSUL_VAULT_MOUNT", "consul")

		var client *vault.Vault
		client, err = vault.New(nil)
		if err != nil {
			return nil, err
		}
		err = client.Login()
		defer client.Logout()
		if err != nil {
			return nil, err
		}

		path := fmt.Sprintf("%s/creds/%s", mount, role)

		var data []byte
		data, err = client.Read(path)
		if err != nil {
			return nil, errors.Wrapf(err, "vault consul auth failed")
		}

		decoded := make(map[string]interface{})
		err = yaml.Unmarshal(data, &decoded)
		if err != nil {
			return nil, errors.Wrapf(err, "Unable to unmarshal object")
		}

		token := decoded["token"].(string)

		// nolint: gosec
		_ = os.Setenv("CONSUL_HTTP_TOKEN", token)
	}
	var kv store.Store
	kv, err = libkv.NewStore(store.CONSUL, []string{c.String()}, config)
	if err != nil {
		return nil, errors.Wrapf(err, "Consul setup failed")
	}
	return &LibKV{kv}, nil
}
117727
func NewCredentials() *credentials.Credentials {
	return credentials.NewChainCredentials(
		new(credentials.EnvProvider),
		new(credentials.FileProvider),
	)
}
666067
func (s *AddTagsToVaultInput) SetVaultName(v string) *AddTagsToVaultInput {
	s.VaultName = &v
	return s
}
563209
func NewHawkularClient(p Parameters) (*Client, error) {
	uri, err := url.Parse(p.Url)
	if err != nil {
		return nil, err
	}

	if (p.Username != "" && p.Password == "") || (p.Username == "" && p.Password != "") {
		return nil, fmt.Errorf("To configure credentials, you must specify both Username and Password")
	}

	if (p.Username != "" && p.Password != "") && (p.Token != "") {
		return nil, fmt.Errorf("You cannot specify both Username/Password credentials and a Token.")
	}

	if uri.Path == "" {
		uri.Path = baseURL
	}

	u := &url.URL{
		Host:   uri.Host,
		Path:   uri.Path,
		Scheme: uri.Scheme,
		Opaque: fmt.Sprintf("/%s", uri.Path),
	}

	c := &http.Client{
		Timeout: timeout,
	}
	if p.TLSConfig != nil {
		transport := &http.Transport{TLSClientConfig: p.TLSConfig}
		c.Transport = transport
	}

	var creds string
	if p.Username != "" && p.Password != "" {
		creds = base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%v:%v", p.Username, p.Password)))
	}

	if p.Concurrency < 1 {
		p.Concurrency = 1
	}

	client := &Client{
		url:         u,
		Tenant:      p.Tenant,
		Credentials: creds,
		Token:       p.Token,
		AdminToken:  p.AdminToken,
		client:      c,
		pool:        make(chan *poolRequest, p.Concurrency),
	}

	for i := 0; i < p.Concurrency; i++ {
		go client.sendRoutine()
	}

	return client, nil
}
136902
func NewClientWithParameters(endpoint *Endpoint, user, password string, params *Parameters) (*Client, error) {

	// alloc a new client
	client := &Client{
		Parameters: *params,
		username:   user,
		password:   password,
		url:        endpoint.url(),
		useHTTPS:   endpoint.HTTPS,
		// default transport
		http: &clientRequest{ dial:params.Dial },
	}

	// switch to other transport if provided
	if params.TransportDecorator != nil {
		client.http = params.TransportDecorator()
	}

	// set the transport to some endpoint configuration
	if err := client.http.Transport(endpoint); err != nil {
		return nil, fmt.Errorf("Can't parse this key and certs: %s", err)
	}

	return client, nil
}
1020870
func NewVAClient() (*VAClient, error) {

	var u *url.URL
	var err error

	if os.Getenv("VCLOUDAIR_ENDPOINT") != "" {
		u, err = url.ParseRequestURI(os.Getenv("VCLOUDAIR_ENDPOINT"))
		if err != nil {
			return &VAClient{}, fmt.Errorf("cannot parse endpoint coming from VCLOUDAIR_ENDPOINT")
		}
	} else {
		// Implicitly trust this URL parse.
		u, _ = url.ParseRequestURI("https://vchs.vmware.com/api")
	}

	VAClient := VAClient{
		VAEndpoint: *u,
		Client: Client{
			APIVersion: "5.6",
			// Patching things up as we're hitting several TLS timeouts.
			Http: http.Client{
				Transport: &http.Transport{
					Proxy:               http.ProxyFromEnvironment,
					TLSHandshakeTimeout: 120 * time.Second,
				},
			},
		},
	}
	return &VAClient, nil
}
305070
func NewKubernetesAuthMethod(conf *auth.AuthConfig) (auth.AuthMethod, error) {
	if conf == nil {
		return nil, errors.New("empty config")
	}
	if conf.Config == nil {
		return nil, errors.New("empty config data")
	}

	k := &kubernetesMethod{
		logger:    conf.Logger,
		mountPath: conf.MountPath,
	}

	roleRaw, ok := conf.Config["role"]
	if !ok {
		return nil, errors.New("missing 'role' value")
	}
	k.role, ok = roleRaw.(string)
	if !ok {
		return nil, errors.New("could not convert 'role' config value to string")
	}

	tokenPathRaw, ok := conf.Config["token_path"]
	if ok {
		k.tokenPath, ok = tokenPathRaw.(string)
		if !ok {
			return nil, errors.New("could not convert 'token_path' config value to string")
		}
	}

	if k.role == "" {
		return nil, errors.New("'role' value is empty")
	}

	return k, nil
}
791134
func NewV4SigningClient(credentials awsauth.Credentials) *http.Client {
	return NewV4SigningClientWithHTTPClient(credentials, http.DefaultClient)
}
1112937
func (c *Connection) vault(vault string) string {
	return "https://" + c.Signature.Region.Glacier + "/-/vaults/" + vault
}
496662
func newKvClient(machine string, p connectionParams) (*api.Config, *api.Client, error) {
	config := api.DefaultConfig()
	config.HttpClient = http.DefaultClient
	config.Address = machine
	config.Scheme = "http"
	config.Token = p.options[kvdb.ACLTokenKey]

	// check if TLS is required
	if p.options[kvdb.TransportScheme] == "https" {
		tlsConfig := &api.TLSConfig{
			CAFile:             p.options[kvdb.CAFileKey],
			CertFile:           p.options[kvdb.CertFileKey],
			KeyFile:            p.options[kvdb.CertKeyFileKey],
			Address:            p.options[kvdb.CAAuthAddress],
			InsecureSkipVerify: strings.ToLower(p.options[kvdb.InsecureSkipVerify]) == "true",
		}

		consulTLSConfig, err := api.SetupTLSConfig(tlsConfig)
		if err != nil {
			logrus.Fatal(err)
		}

		config.Scheme = p.options[kvdb.TransportScheme]
		config.HttpClient = new(http.Client)
		config.HttpClient.Transport = &http.Transport{
			TLSClientConfig: consulTLSConfig,
		}
	}

	client, err := api.NewClient(config)
	if err != nil {
		logrus.Info("consul: failed to get new api client: %v", err)
		return nil, nil, err
	}

	// check health to ensure communication with consul are working
	if _, _, err := client.Health().State(api.HealthAny, nil); err != nil {
		logrus.Errorf("consul: health check failed for %v : %v", machine, err)
		return nil, nil, err
	}

	return config, client, nil
}
663525
func New(k kv.Service, cl *api.Client, config Config) (Vault, error) {

	if config.SecretShares < config.SecretThreshold {
		return nil, errors.New("the secret threshold can't be bigger than the shares")
	}

	return &vault{
		keyStore: k,
		cl:       cl,
		config:   &config,
	}, nil
}
1245082
func (g *rfc4122Generator) NewV5(ns UUID, name string) UUID {
	u := newFromHash(sha1.New(), ns, name)
	u.SetVersion(V5)
	u.SetVariant(VariantRFC4122)

	return u
}
155428
func NewV3(ns UUID, name string) UUID {
	return global.NewV3(ns, name)
}