Documentation
¶
Overview ¶
Package backend selects a secrets cipher by name, so every binary that encrypts vault credential material constructs it from the same config point instead of each mapping the environment its own way.
It is a sibling of internal/secrets rather than part of it — the shape internal/sandbox/backend already has, and for the same structural reason: the seam package holds the interface AND the sentinel errors backends wrap, so it must not import them. FromEnv lived in internal/secrets until the gcpkms backend needed secrets.ErrPlaintextTooLarge, which would have closed the loop into an import cycle.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FromEnv ¶
FromEnv builds the cipher from the SECRETS_*/BAO_*/GCPKMS_* environment — the one construction the controlplane and executor binaries share, so their notion of "configured" cannot drift. (nil, nil) when SECRETS_BACKEND is unset: the cipher is optional like object storage, and each binary decides what its absence means (vault credential storage reports it). Once a backend is selected, missing configuration fails rather than degrades — the modeltest rule: opting in makes misconfiguration an error, never a silent fallback.
Types ¶
This section is empty.
Source Files