Documentation
¶
Overview ¶
Package sharedenv composes internal/store's shared env var tables (project_env_vars, organization_env_vars, environment_env_vars) with internal/secrets' envelope encryption, so a secret-marked shared env var resolves to its decrypted plaintext by the time internal/reconcile/application's resolveEnv merges it into a running container's environment. *store.DB alone already satisfies resolveEnv's ProjectEnvStore/OrganizationEnvStore/EnvironmentEnvLister interfaces for the plain-value case (it always has); Resolver is a drop-in replacement wherever those are wired up (cmd/levelrail/main.go's appControllersFor) that also resolves the secret-marked case, without resolveEnv itself needing to know the difference.
Index ¶
- type Resolver
- func (r *Resolver) ListEnvironmentEnvVars(ctx context.Context, environmentID string) (map[string]string, error)
- func (r *Resolver) ListOrganizationEnvVarsForProject(ctx context.Context, projectID string) (map[string]string, error)
- func (r *Resolver) ListProjectEnvVars(ctx context.Context, projectID string) (map[string]string, error)
- type SecretResolver
- type Store
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver decrypts secret-marked shared env vars fresh on every call (every reconcile), never caching a plaintext value across calls, the same discipline internal/secrets.Manager.Resolve's own callers already hold.
func NewResolver ¶
NewResolver builds a Resolver. secretsManager may be nil (a control plane with no master key configured): secret-marked shared env vars are then silently omitted from every List* call below, the same "everything except secret resolution still works" shape internal/api's own SecretSetter nil case already establishes. Taking the concrete *secrets.Manager, not an interface, so a nil check here works correctly rather than tripping the typed-nil-interface trap a nil-but-typed SecretResolver parameter would.
func (*Resolver) ListEnvironmentEnvVars ¶
func (r *Resolver) ListEnvironmentEnvVars(ctx context.Context, environmentID string) (map[string]string, error)
ListEnvironmentEnvVars satisfies internal/reconcile/application's EnvironmentEnvLister, merging environmentID's plain shared env vars with its decrypted secret-marked ones.
func (*Resolver) ListOrganizationEnvVarsForProject ¶
func (r *Resolver) ListOrganizationEnvVarsForProject(ctx context.Context, projectID string) (map[string]string, error)
ListOrganizationEnvVarsForProject satisfies internal/reconcile/ application's OrganizationEnvStore, merging projectID's organization's plain shared env vars with its decrypted secret-marked ones.
func (*Resolver) ListProjectEnvVars ¶
func (r *Resolver) ListProjectEnvVars(ctx context.Context, projectID string) (map[string]string, error)
ListProjectEnvVars satisfies internal/reconcile/application's ProjectEnvStore, merging projectID's plain shared env vars with its decrypted secret-marked ones.
type SecretResolver ¶
type SecretResolver interface {
Resolve(ctx context.Context, serviceName, envKey string) (string, error)
}
SecretResolver is the narrow surface Resolver needs from internal/secrets.Manager: decrypt one secret-marked shared env var's value, the same Resolve call internal/reconcile/application's own SecretResolver already makes for per-app secrets, database passwords, and every other envelope-encrypted credential in this control plane.
type Store ¶
type Store interface {
ListProjectEnvVars(ctx context.Context, projectID string) (map[string]string, error)
ListProjectSecretEnvKeys(ctx context.Context, projectID string) ([]string, error)
ListOrganizationEnvVarsForProject(ctx context.Context, projectID string) (map[string]string, error)
GetProjectOrganizationID(ctx context.Context, projectID string) (string, error)
ListOrganizationSecretEnvKeys(ctx context.Context, orgID string) ([]string, error)
ListEnvironmentEnvVars(ctx context.Context, environmentID string) (map[string]string, error)
ListEnvironmentSecretEnvKeys(ctx context.Context, environmentID string) ([]string, error)
}
Store is the store surface Resolver needs across all three shared-env tiers, satisfied structurally by *store.DB.
Source Files