.. _envoy_v3_api_file_envoy/extensions/formatter/generic_secret/v3/generic_secret.proto:

Formatter extension for printing values from generic secrets (proto)
====================================================================

.. _extension_envoy.formatter.generic_secret:

This extension has the qualified name ``envoy.formatter.generic_secret``


.. note::
  This extension is functional but has not had substantial production burn time,
  use only with this caveat.

  This extension is intended to be robust against both untrusted downstream and
  upstream traffic.

.. tip::
  This extension extends and can be used with the following extension category:


  - :ref:`envoy.formatter <extension_category_envoy.formatter>`



  This extension must be configured with one of the following type URLs:



  - :ref:`type.googleapis.com/envoy.extensions.formatter.generic_secret.v3.GenericSecret <envoy_v3_api_msg_extensions.formatter.generic_secret.v3.GenericSecret>`







.. _envoy_v3_api_msg_extensions.formatter.generic_secret.v3.GenericSecret:

extensions.formatter.generic_secret.v3.GenericSecret
----------------------------------------------------


:repo:`[extensions.formatter.generic_secret.v3.GenericSecret proto] <api/envoy/extensions/formatter/generic_secret/v3/generic_secret.proto#L45>`

GenericSecret formatter extension implements the ``%SECRET(name)%`` command operator that
resolves the value of a named generic secret obtained via SDS or static bootstrap configuration.

The secret must be a :ref:`GenericSecret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.GenericSecret>`
with the ``secret`` field set.

Example configuration adding an authorization header with a secret obtained via SDS:

.. code-block:: yaml

  http_uri:
    uri: https://api.example.com/v1/data
    cluster: api_backend
    timeout: 5s
  request_headers_to_add:
  - header:
      key: "authorization"
      value: "Bearer %SECRET(my-api-token)%"
  formatters:
  - name: envoy.formatter.generic_secret
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.formatter.generic_secret.v3.GenericSecret
      secret_configs:
        my-api-token:
          name: bearer-token
          sds_config:
            ads: {}



.. code-block:: json
  :force:

  {
    "secret_configs": {...}
  }

.. _envoy_v3_api_field_extensions.formatter.generic_secret.v3.GenericSecret.secret_configs:


secret_configs
  (**repeated** map<`string <https://developers.google.com/protocol-buffers/docs/proto#scalar>`_, :ref:`extensions.transport_sockets.tls.v3.SdsSecretConfig <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.SdsSecretConfig>`>) Map from formatter lookup name to SDS secret configuration. The map key is the name used
  in the ``%SECRET(name)%`` command operator.