Documentation
¶
Overview ¶
This file implements the CredentialProvider plugin API backed by Kubernetes Secrets. It resolves ate-secret:// URIs of the provider "k8s.io" to a Secret value read straight from the Kubernetes API — so Substrate never stores the secret, it only brokers a read the provider is authorized to perform.
Command kubernetes-secrets is the Kubernetes-Secrets credential-provider plugin: a gRPC service that resolves ate-secret:// URIs of the k8s.io provider to Kubernetes Secret values. It is the only component in the egress credential-injection path with Kubernetes access; the egress gateway and its injector never read Secrets directly.
The provider's /statusz page, mirroring the atenet router's: one handler serving an HTML dashboard by default and JSON under ?format=json (or Accept: application/json). It shows the provider's configuration as the running process holds it — notably the authorization policy loaded at startup, which the ConfigMap on disk may have since drifted from. Names and configuration only, never secret values.
Source Files