applicationsecretapi

type DynamicSecretService ¶

type DynamicSecretService interface {
	CreateDynamic(context.Context, string, []byte) (applicationsecret.Reference, error)
	ReadDynamic(context.Context, string, applicationsecret.Reference) ([]byte, error)
	RotateDynamic(context.Context, string, applicationsecret.Reference, []byte) error
	DeleteDynamic(context.Context, string, applicationsecret.Reference) error
}

DynamicSecretService is the optional application-facing managed-secret extension. The existing named-secret operator contract remains independent.

type Handler ¶

type Handler struct {
	// contains filtered or unexported fields
}

func New(secrets SecretService, ownership OwnershipResolver, rbac *authorization.Service) (*Handler, error)

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request)

type OwnershipResolver ¶

type OwnershipResolver interface {
	OwnedByTenant(context.Context, string, string) (bool, error)
}

OwnershipResolver proves that an application belongs to the resolved tenant. Implementations must fail closed when ownership is unknown or ambiguous.

type SecretService ¶

type SecretService interface {
	List(context.Context, string) ([]applicationsecret.Metadata, error)
	Set(context.Context, string, string, []byte) error
	Delete(context.Context, string, string) error
}

SecretService is the transport-facing subset of the application secret service.