Documentation
¶
Overview ¶
Package secrets resolves Dapr component secret references (secretKeyRef and envRef) against local secret stores. Resolution delegates to components-contrib's own secretstores/local/{file,env} implementations, so nestedSeparator flattening, multiValued, and prefix behave exactly as they do in the Dapr runtime rather than being re-derived here.
Index ¶
Constants ¶
const ( TypeFile = "secretstores.local.file" TypeEnv = "secretstores.local.env" )
TypeFile and TypeEnv are the two local secret-store types this package can resolve. Any other secretstores.* type is detected and reported, never read.
const MaxKeyNames = 200
MaxKeyNames caps how many secret names KeyNames returns. The cap is reported to the caller rather than applied silently.
Variables ¶
This section is empty.
Functions ¶
func EnvVarAllowed ¶
EnvVarAllowed mirrors dapr/pkg/runtime/processor/secret.isEnvVarAllowed: a denylist of empty names, APP_API_TOKEN, any DAPR_-prefixed name, and any name containing a space; then, when DAPR_ENV_KEYS is set (the Kubernetes injector sets it), a space-separated allowlist on top.
func IsSecretStoreType ¶
IsSecretStoreType reports whether a component type declares a secret store.
func ParseRefs ¶
ParseRefs extracts auth.secretStore and every secret reference from a single component YAML document. A metadata entry is a reference when it carries a secretKeyRef.name or an envRef; entries with a plain value are skipped. Dapr gives secretKeyRef precedence over envRef when both are somehow present.
Types ¶
type Ref ¶
type Ref struct {
Kind string // "secretKeyRef" | "envRef"
Name string // secret name, or the env var name for envRef
Key string // "" means: fall back to Name
}
Ref is a single secret reference from a component's spec.metadata entry.
func (Ref) EffectiveKey ¶
EffectiveKey is the key actually looked up. Dapr falls back to the secret name when secretKeyRef.key is omitted.
type Result ¶
type Result struct {
Status Status
Value string
Detail string // human-facing: the env var name or absolute file path tried
// FromEnv reports that the outcome depends on what the dashboard's own
// process environment contains. daprd reads its own environment, which
// need not match, so such an outcome says nothing about daprd.
FromEnv bool
}
Result is the outcome of one Resolve call. Value is populated for callers on the reveal path only; it must never be serialized into a list response.
type Service ¶
type Service interface {
// Stores returns every detected secret-store component, with File and
// InitErr populated for the local types.
Stores(ctx context.Context) []Store
// Resolve looks up ref in the store named storeName. An empty storeName
// yields StatusStoreNotSpecified — Dapr has no default in standalone mode.
Resolve(ctx context.Context, storeName string, ref Ref) Result
// KeyNames returns the store's available secret names (never values).
// capped reports whether the list was truncated.
KeyNames(ctx context.Context, storeName string) (names []string, capped bool, err error)
}
Service resolves secret references against detected local secret stores.
type Status ¶
type Status string
Status is the outcome of resolving one reference.
const ( StatusResolved Status = "resolved" StatusStoreNotSpecified Status = "store-not-specified" StatusStoreNotFound Status = "store-not-found" StatusStoreUnsupported Status = "store-unsupported" StatusStoreUnreadable Status = "store-unreadable" StatusKeyNotFound Status = "key-not-found" StatusEmptyValue Status = "empty-value" StatusForbidden Status = "forbidden" )
type Store ¶
type Store struct {
Name string // metadata.name
Type string // spec.type
Path string // absolute path of the YAML that declared it
Properties map[string]string // spec.metadata, verbatim
File string // local.file: the absolute secretsFile actually opened
InitErr string // non-empty when the store could not be initialized
}
Store is a detected secret-store component.
func DetectStores ¶
DetectStores walks the given files or directories and returns every secret-store component found, including unsupported types (so a reference to one can report store-unsupported rather than store-not-found).
Source Files