Documentation
¶
Overview ¶
Package detect resolves which cloud provider should back the flat `param` / `secret` command aliases and a bare `suve --tui` / `suve --gui` launch, and hydrates a launch scope's resource fields, based purely on environment variables. It performs no network calls and no credential-chain resolution, so it is safe to run on every process start (including on the shell-completion path, where speed matters).
The rules (per service, param and secret decided independently):
- A provider is "active via env" when one of its address/identity/ambient env vars is set: AWS — AWS_ACCESS_KEY_ID | AWS_VAULT | AWS_PROFILE | AWS_DEFAULT_PROFILE, or an ambient-credential marker set by AWS-managed compute: AWS_CONTAINER_CREDENTIALS_FULL_URI (CloudShell, App Runner, EKS Pod Identity), AWS_CONTAINER_CREDENTIALS_RELATIVE_URI (ECS), or AWS_WEB_IDENTITY_TOKEN_FILE (IRSA / EKS). This is what makes the flat aliases work in AWS CloudShell, where none of the classic vars are set. GoogleCloud — GOOGLE_CLOUD_PROJECT (secret only) Azure — AZURE_KEYVAULT_NAME (secret) / AZURE_APPCONFIG_NAME (param)
- A flat alias is exposed for a service only when exactly ONE provider is active for it. Zero or two-plus active means no alias — the user must use the explicit group (e.g. `suve aws secret`). There is no priority order.
- AWS-only final fallback: when NO provider is active via env for any service, AWS is accepted via ~/.aws/credentials or ~/.aws/config (an SSO-only setup has just the config file), so the common "plain AWS" setup keeps working. If both files are absent, nothing is aliased.
Deliberately NOT detected: an EC2 instance profile with no credentials env var and no shared file delivers credentials only through IMDS, which has no env marker and would require a network probe. Running suve from a bare EC2 host is rare; there the explicit `suve aws ...` group still works.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrUnknownProvider = errors.New("unknown provider")
ErrUnknownProvider is returned by HydrateScope for an unknown or empty provider.
Functions ¶
func HydrateScope ¶ added in v1.10.0
HydrateScope fills the empty resource fields of a launch scope from the environment, so a flag-supplied value wins and an unset one falls back to GOOGLE_CLOUD_PROJECT / AZURE_KEYVAULT_NAME / AZURE_APPCONFIG_NAME / AZURE_APPCONFIG_NAMESPACE. AWS carries no resource field (the region comes from the ambient AWS config). An unknown provider is an error.
Types ¶
type Environment ¶
type Environment struct {
// Getenv reads an environment variable (os.Getenv in production).
Getenv func(string) string
// file is present. It is only consulted for the final fallback, never eagerly.
AWSSharedFilesExist func() bool
}
Environment abstracts the inputs the resolver reads, so it can be tested without mutating the real process environment or filesystem.
func OSEnvironment ¶
func OSEnvironment() Environment
OSEnvironment returns an Environment backed by the real OS.
type Result ¶
type Result struct {
// Param and Secret name the single active provider for that service, or an
// empty Provider ("") when the service is not uniquely resolvable (0 or 2+
// active) — meaning no flat alias should be exposed for it.
Param provider.Provider
Secret provider.Provider
// Stage names the single active provider for the staging workflow, or an
// empty Provider ("") when staging is not uniquely resolvable (0 or 2+
// staging-capable providers active). Staging is supported for AWS (param +
// secret), Google Cloud (secret), and Azure (Key Vault secret / App
// Configuration param).
Stage provider.Provider
// ParamActive and SecretActive list every provider active for that service,
// in stable order (AWS, GoogleCloud, Azure).
ParamActive []provider.Provider
SecretActive []provider.Provider
// StageActive lists every staging-capable provider active, in stable order
// (AWS, GoogleCloud, Azure).
StageActive []provider.Provider
// AWSViaFallback is true when AWS became active only through the
// ~/.aws/credentials or ~/.aws/config fallback (no provider was active via
// env).
AWSViaFallback bool
}
Result holds the resolved flat-alias target for each service plus the full active sets (useful for help text and the GUI).
func Resolve ¶
func Resolve(env Environment) Result
Resolve computes the alias targets from the given environment.
func (Result) ActiveProviders ¶ added in v1.10.0
ActiveProviders lists every provider active on any service axis (param, secret, or stage), deduplicated, in provider.Providers order.
func (Result) FlatSecret ¶
FlatSecret reports whether a top-level `secret` alias should be exposed.
func (Result) UniqueProvider ¶ added in v1.10.0
UniqueProvider returns the sole provider active on any service axis, or "" when zero or two-plus are active. It is the "exactly one active provider" rule for a bare UI launch (`suve --tui`, `suve --gui`).
Source Files