Documentation
¶
Overview ¶
Package credentials defines the credential-resolution seam shared by the service layer and its consumers (validators, workers). The canonical implementation lives in pkg/services; the types are declared here so packages that the services layer itself depends on can consume the resolver without an import cycle.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClusterSecretNameForGitHost ¶
ClusterSecretNameForGitHost returns the deterministic name of the cluster secret synthesized for an org-level git integration.
func ClusterSecretNameForRegistryHost ¶
func ClusterSecretNameForRegistryHost(host string, purpose RegistryPurpose) string
ClusterSecretNameForRegistryHost returns the deterministic name of the cluster secret synthesized for an org-level registry credential. The purpose is part of the name so a pull credential and a push credential sharing a host (potentially different accounts) map to distinct cluster secrets.
Types ¶
type GitAuthSelector ¶
type GitAuthSelector struct {
// IntegrationID pins an org-level git integration; resolution lands with
// git integrations.
IntegrationID string
}
GitAuthSelector carries the explicit per-resource overrides for git credential resolution. The zero value selects no override.
type RegistryAuthSelector ¶
type RegistryAuthSelector struct {
// RegistryCredentialID pins an org-level registry credential, overriding
// host auto-attach.
RegistryCredentialID string
}
RegistryAuthSelector carries the explicit per-resource overrides for registry credential resolution. The zero value selects no override.
type RegistryPurpose ¶
type RegistryPurpose string
RegistryPurpose distinguishes pull from push resolution for registries.
const ( RegistryPurposePull RegistryPurpose = "pull" RegistryPurposePush RegistryPurpose = "push" )
type ResolvedGitCredential ¶
type ResolvedGitCredential struct {
Source Source
Credentials gitclient.GitCredentials // zero value == anonymous
DataHash string // for SecretDataHashAnnotation / release freezing
// IntegrationID and Host identify the org-level git integration when
// Source == SourceIntegration.
IntegrationID string
Host string
// TokenMintedAt/TokenExpiresAt are set when the credentials are a minted
// GitHub App installation token; they drive hub-side refresh.
TokenMintedAt *time.Time
TokenExpiresAt *time.Time
}
type ResolvedRegistryCredential ¶
type ResolvedRegistryCredential struct {
Source Source
Username string
Password string
DataHash string
// CredentialID and Host identify the org-level registry credential when
// Source == SourceIntegration. Host is the normalized registry host.
CredentialID string
Host string
// Purpose is the resolution purpose (pull vs push) this credential was
// resolved for. It disambiguates the deterministic cluster-secret name for
// org-level credentials: a pull credential and a push credential can share
// the same host but hold different accounts, so they must not collide.
Purpose RegistryPurpose
}
type Resolver ¶
type Resolver interface {
GitCredentials(ctx context.Context, orgID, repoURL string, selector GitAuthSelector) (*ResolvedGitCredential, *errors.ServiceError)
RegistryCredentials(ctx context.Context, orgID, ref string, purpose RegistryPurpose, selector RegistryAuthSelector) (*ResolvedRegistryCredential, *errors.ServiceError)
}
Resolver resolves credentials for git/registry targets with fixed precedence: explicit secret ref > explicit integration/credential ID > org-level integration matched by host > anonymous.
Source Files