Documentation
¶
Overview ¶
pkg/secrets
Shared secret lifecycle utilities used by both the runtime and the gateway.
These helpers live here rather than in pkg/runtime/runners/ because the gateway Apply API also needs secret existence checks and rotation logic for token secret management. Extracting them here avoids a gateway → runtime import.
Index ¶
- func DeleteSecretForRotation(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) error
- func GenerationAnnotations(rotateAfter string) map[string]string
- func IsNotFoundErr(err error) bool
- func SecretExists(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) (bool, error)
- func SecretNeedsRotation(ctx context.Context, kube kubeclient.KubeClient, ...) (bool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DeleteSecretForRotation ¶
func DeleteSecretForRotation(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) error
DeleteSecretForRotation deletes a Secret so it can be recreated with fresh values. Called when SecretNeedsRotation returns true. The next create call then generates new credentials and annotates with the current time.
func GenerationAnnotations ¶
GenerationAnnotations returns the annotations to add to a freshly generated Secret.
func IsNotFoundErr ¶
IsNotFoundErr returns true when err is a Kubernetes 404 Not Found error.
func SecretExists ¶
func SecretExists(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) (bool, error)
SecretExists checks whether a Secret with the given name exists in the namespace. Uses ResourceVersion: "0" to read from the API server watch cache (not etcd). Returns true if the secret exists, false on NotFound, error on API failure.
func SecretNeedsRotation ¶
func SecretNeedsRotation(ctx context.Context, kube kubeclient.KubeClient, namespace, name, rotateAfter string) (bool, error)
SecretNeedsRotation returns true when the Secret exists but has exceeded its rotation threshold. Reads the generated-at annotation and compares to the declared rotateAfter duration.
Returns false (no rotation) when:
- rotateAfter is not set
- Secret does not exist
- Generated-at annotation is missing or unparseable → regenerate to be safe
Types ¶
This section is empty.
Source Files