Documentation
¶
Overview ¶
Package secrets resolves secret material read from an application's source tree — a values file committed encrypted, for instance.
It does not supply the controller's own credentials. Git tokens, SSH keys and registry authentication arrive as Docker secrets: encrypted at rest in the raft log and delivered in memory, which is what swarmcli-rbac-proxy already does for its TLS material. Those are configuration, not a seam.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Provider ¶
Provider resolves secret material to plaintext.
A provider that does not recognise the material returns Data unchanged and no error, so an unencrypted file passes cleanly through any provider. It errors only when it recognises the material and cannot resolve it — a corrupt ciphertext, a key it does not hold. Refusing to deploy is the right answer there; rendering a stack from a values file that is still ciphertext is not.
type Request ¶
type Request struct {
// Application names the application whose source tree the material was
// read from.
//
// It is here because a provider holding per-application key material — the
// shape projects and SOPS take together — cannot otherwise pick a key: a
// path and some bytes say nothing about who they belong to. It is the
// application's name as the app set declares it, so it is also the name
// every log line and API response about that application already uses.
Application string
// Path is where the material was read from, relative to the repository
// root. An implementation may decide by name or extension.
Path string
// Data is the material as it was read.
Data []byte
}
Request is one piece of material to resolve.
It is a struct rather than a parameter list so that the seam can grow without breaking the companion module that implements it: an implementation receives the struct, so a field added later — a reference to fetch rather than bytes to decrypt, an application scope — costs it nothing. Widening a parameter list would be a breaking change to an interface implemented outside this repository.
Source Files