Documentation
¶
Overview ¶
Package gitcreds leases the credential a git workspace fetch needs.
It sits between pkg/secretbroker, which knows about grants and constraints, and the executor drivers, which know about Pods and edge devices and must not know about either. The drivers see executor.WorkspaceCredentialSource — an interface with no broker types in it — so a driver can be tested with a fake source, and so pkg/executor stays a leaf package that a remote agent can depend on without pulling in the hub's secret store.
Why the lease is taken by the driver and not by the caller ¶
The obvious alternative is for the Web UI to lease the token and put it in the Spec. It cannot: a Spec is persisted by pkg/executorstore, marshalled across the remote-executor boundary, and echoed into audit rows. A credential placed there would be durable in three places by the time anything used it.
So the Spec carries only the *name* of a grant, and the driver dispatching the workload leases the material at the last possible moment, holds it for the length of one fetch, and releases it. The credential's lifetime is a property of the code path rather than of anyone remembering to wipe it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BrokerSource ¶
type BrokerSource struct {
// Broker is the control plane's secret broker.
Broker *secretbroker.Broker
// ExecutorID is the subject grants are matched against.
ExecutorID string
// Actor is the audit-trail identity for the lease.
Actor string
}
BrokerSource leases workspace credentials from a secret broker.
func New ¶
func New(broker *secretbroker.Broker, executorID, actor string) (*BrokerSource, error)
New returns a source, or an error when it would be unusable.
func (*BrokerSource) ForWorkspace ¶
func (s *BrokerSource) ForWorkspace(ctx context.Context, projectID string, w executor.Workspace) (executor.WorkspaceAccess, func(), error)
ForWorkspace implements executor.WorkspaceCredentialSource.
The returned release function is always non-nil, including on the error paths, so a caller can defer it unconditionally.
Selection is by *authority*, not by name alone. A grant satisfies the workspace when it is a GitHub credential whose repository allowlist admits this repository — and, when the spec named a grant, when it is that one. A grant that names the right secret but excludes the repository is reported as a distinct Reason, because "create a grant" and "widen the grant you have" are different fixes and an operator who is told the wrong one will go looking in the wrong place.
Source Files