Documentation
¶
Overview ¶
Package secrets resolves ${secret:<provider>/<path>} references by running host providers. Load and validation never call this package.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Error ¶
Error is a value-free provider failure. Error() never includes stdout, stderr, or the resolved value.
type Provider ¶
type Provider interface {
Resolve(ctx context.Context, path string) (string, error)
Name() string
Type() string
}
Provider resolves one secret path.
func NewExec ¶
func NewExec(cfg config.SecretProvider, env []string) Provider
NewExec builds an argv provider. {{path}} is replaced inside each element. The command is never passed to a shell.
func NewOnePassword ¶
func NewOnePassword(cfg config.SecretProvider, env []string) Provider
NewOnePassword builds an `op read` provider. The binary is looked up once at construction; a missing binary is reported at resolve time.
type Reference ¶
Reference is one secret:<provider>/<path> token.
func ParseReference ¶
ParseReference parses a secret:<provider>/<path> key. The path may contain slashes. A leading ${} wrapper is not accepted.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver runs providers for one pass. The cache is per resolver, so a reload or retry builds a new one.
func NewResolver ¶
func NewResolver(providers []config.SecretProvider, env []string) *Resolver
NewResolver builds providers from the stack declaration and the daemon environment. Unknown types are omitted; a reference to one fails at resolve time as an undeclared provider.
func (*Resolver) Resolve ¶
Resolve returns the value for one reference. Distinct references run at most four at a time. A repeated reference in the same resolver reuses the first result, including a failure, and does not start a second process.
func (*Resolver) ResolveStack ¶
func (r *Resolver) ResolveStack(ctx context.Context, stack *config.Stack) (*config.Stack, map[string]error, []string, error)
ResolveStack substitutes every secret reference in a deep copy. Failed servers and resources are removed. A gateway, network, or stack-name failure is returned under the key "stack" and as a non-nil error. The value list is successful resolutions in first-seen order.
Source Files