secretsource

type Backend ¶

type Backend struct {
	// Connections and Variables mark which kinds this backend serves. A prefix
	// alone does not enable a kind (a flat namespace has an empty prefix), and a
	// zero Backend serves nothing — an unconfigured operator never accepts an
	// undeclared external name at registration.
	Connections bool
	Variables   bool

	// ConnectionsPrefix and VariablesPrefix are the provider namespaces a leoflow
	// name is resolved under, mirroring Airflow's AWS backend kwargs. Empty means a
	// flat namespace (the name maps through unchanged).
	ConnectionsPrefix string
	VariablesPrefix   string
}

Backend is an operator-configured external secret store (set via Helm, never by a DAG author). It names which kinds it serves and the prefix under which a leoflow name is found in the provider. Keeping this operator-sourced is a security invariant: the ADR 0055 D6 registration check consults Covers to accept an externally-backed declared name without a provider call, so if a DAG could supply its own Backend it could mark any name "covered" and defeat D6.

func (b Backend) Covers(kind Kind) bool

func (b Backend) SecretID(name string, kind Kind) string

type BackendConfig ¶

type BackendConfig struct {
	// Class is the provider backend class the in-pod resolver subprocess
	// instantiates (e.g. the Airflow AWS SecretsManagerBackend).
	Class string
	// Kwargs is the raw backend kwargs JSON, passed to the subprocess on stdin
	// (never argv/env — a shared PID namespace makes those task-readable).
	Kwargs json.RawMessage
	// Routing is the declaration-scope predicate (Covers) + name→provider-id
	// mapping (SecretID), derived from the kwargs prefixes.
	Routing Backend
}

BackendConfig is the operator-supplied external-secrets backend configuration, read pod-side from the LEOFLOW_SECRETS_* env the control plane injects (operator only — the dispatch filter keeps an author's task env from setting LEOFLOW_ keys, #828). It is never author-influenced.

func ParseBackendConfig(class, kwargsJSON string) (cfg BackendConfig, enabled bool, err error)

type BatchResolver ¶

type BatchResolver interface {
	ResolveBatch(ctx context.Context, refs []Ref) (map[Ref]string, error)
}

BatchResolver resolves many declared names in a single call. The 2b in-pod resolver pays a heavy per-invocation startup (a Python/Airflow subprocess), so it must batch rather than spawn once per name. A resolver may implement both interfaces; the chain prefers ResolveBatch when available. The returned map holds only the hits (a clean miss is an omission → the vault fallback stands); a non-nil error is a hard failure the caller fails closed on.

type Kind ¶

type Kind int

Kind distinguishes a connection (resolves to an Airflow connection URI) from a variable (resolves to a scalar value). The resolver learns only the leoflow-declared name and its kind — never a provider path, ARN, or mount.

const (
	// KindConnection resolves to a rendered Airflow connection URI.
	KindConnection Kind = iota
	// KindVariable resolves to a scalar variable value.
	KindVariable
)

type NoOp ¶

type NoOp struct{}

NoOp is the default resolver, used when no external backend is configured. It resolves nothing, so the chain falls through to the vault — behavior identical to the pre-ADR-0060 env-export path. A DAG that declares no external backend gets byte-identical secrets delivery.

func (NoOp) Resolve(_ context.Context, _ string, _ Kind) (value string, found bool, err error)

type Ref ¶

type Ref struct {
	Name string
	Kind Kind
}

Ref identifies one declared secret to resolve: its leoflow name and kind.

type SecretResolver ¶

type SecretResolver interface {
	Resolve(ctx context.Context, name string, kind Kind) (value string, found bool, err error)
}

SecretResolver resolves one leoflow-declared name to its value using an identity the pod already carries. It never receives credentials, a provider path, or an ARN — those live in the adapter's operator-supplied config, bound to the pod's workload identity.

Resolve returns (value, found, err). found=false is a clean miss: the caller falls through to the next link in the chain (the leoflow vault). A non-nil err is a hard failure (access denied, throttle, malformed value); the caller fails closed for a required name rather than masking it.