Documentation
¶
Overview ¶
Package secrets resolves secret configuration for SAM binaries.
Daemon-lifetime secrets are never accepted as flag values: command lines leak via /proc/<pid>/cmdline (world-readable), shell history, CI logs, and pod specs. They are accepted from a file (--<name>-path, the recommended production channel — e.g. a Kubernetes Secret volume) or an environment variable (developer convenience; /proc/<pid>/environ is owner-only).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FromPathOrEnv ¶
FromPathOrEnv resolves a daemon-lifetime secret: the file at path wins, the environment variable is the fallback. File and env contents are whitespace-trimmed; a configured but empty file is an error. An empty result means the secret was not configured at all.
func Resolve ¶
Resolve returns a one-shot secret configured either directly (value) or via a file (path). Setting both is an error; file contents are whitespace-trimmed and must be non-empty. Direct values are tolerated for short-lived interactive flows (e.g. enrollment); daemon-lifetime secrets use FromPathOrEnv instead.
Types ¶
This section is empty.
Source Files