Documentation
¶
Overview ¶
Package secretstore implements the REST plumbing that makes SecretStore values write-only: a redacting wrapper that strips stored values from every main-resource response, a "values" subresource that is the single path through which values are written and (by internal identities only) read, and the authorizer gate that enforces the read restriction.
Values live on the stored SecretStore's top-level Data field (mirroring corev1.Secret), so the main resource and the values subresource share one logical store; only the response shaping differs.
Index ¶
- Constants
- func AllowAllReads(user.Info) bool
- func NewValuesReadAuthorizer(delegate authorizer.Authorizer, allow ReadAuthz) authorizer.Authorizer
- func RedactedProvider(base serverapiserver.StorageProvider) serverapiserver.StorageProvider
- func ValuesProvider(base serverapiserver.StorageProvider) serverapiserver.StorageProvider
- type ReadAuthz
Constants ¶
const ValuesSubResource = "values"
ValuesSubResource is the subresource name under secretstores.
Variables ¶
This section is empty.
Functions ¶
func AllowAllReads ¶
AllowAllReads is the single-node/OSS default: the local apiserver is a single-user trust domain (the backing SQLite file sits on the same disk), so value reads are not restricted. Redacted main-resource reads remain for interface consistency with hosted deployments.
func NewValuesReadAuthorizer ¶
func NewValuesReadAuthorizer(delegate authorizer.Authorizer, allow ReadAuthz) authorizer.Authorizer
NewValuesReadAuthorizer wraps an authorizer and denies reads of the values subresource unless the identity passes allow. Writes (update/patch) are not restricted here — any project identity may set values it can never read back. Enforcing at the authorization layer (rather than in storage) keeps the PATCH flow intact: the patch handler's internal storage Get is not a separately authorized request.
func RedactedProvider ¶
func RedactedProvider(base serverapiserver.StorageProvider) serverapiserver.StorageProvider
RedactedProvider wraps a genericregistry.Store-producing provider (the builder's standard kine-backed one) so main-resource responses never carry stored secret values.
func ValuesProvider ¶
func ValuesProvider(base serverapiserver.StorageProvider) serverapiserver.StorageProvider
ValuesProvider mounts the values subresource over the same logical store: it instantiates the base provider (a second registry.Store against the same backend, exactly like the builder's status-subresource path) and swaps in the values update strategy.
Source Files