Documentation
¶
Overview ¶
Package secrets resolves secret configuration for SAM binaries.
Daemon-lifetime secrets are never accepted as flag values: command lines leak via /proc/<pid>/cmdline (world-readable), shell history, CI logs, and pod specs. They are accepted from a file (--<name>-path, the recommended production channel — e.g. a Kubernetes Secret volume) or an environment variable (developer convenience; /proc/<pid>/environ is owner-only).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FromPathOrEnv ¶
FromPathOrEnv resolves a daemon-lifetime secret: the file at path wins, the environment variable is the fallback. File and env contents are whitespace-trimmed; a configured but empty file is an error. An empty result means the secret was not configured at all.
The environment variable is removed from this process's environment in either case, so subprocesses (MCP command backends, re-executed daemons) do not inherit it.
func Resolve ¶
Resolve returns a one-shot secret configured either directly (value) or via a file (path). Setting both is an error; file contents are whitespace-trimmed and must be non-empty. Direct values are tolerated for short-lived interactive flows (e.g. enrollment); daemon-lifetime secrets use FromPathOrEnv instead.
Types ¶
This section is empty.
Source Files