Documentation
¶
Overview ¶
Package secrets is the secrets delivery resolver (ADR-0022): it reads a function's bound Secret resources (auto-decrypted by the store's at-rest encryptor) and returns their data as an env-var map for worker injection — PDP-authorized (the secrets PEP). The injection is the function reconciler's secret gate (ADR-0057, internal/function): it resolves the bound Secrets through this resolver before any worker is provisioned and merges them into the worker's env (V1 delivers env only; tmpfs is V2). The at-rest encryptor lives in internal/secrets/aesgcm.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnvDataProblem ¶ added in v0.2.3
EnvDataProblem returns the first key of data, in sorted order, whose value EnvValueProblem rejects, with the problem; "" and "" if env delivery can carry every value. The sorted order keeps the error, and so a Function's Ready message, the same from one reconcile to the next.
func EnvValueProblem ¶ added in v0.2.2
EnvValueProblem says why v cannot be delivered as a worker env value, or returns "" if it can: a value that is not valid UTF-8 would reach the worker as U+FFFD, and exec rejects a NUL byte. It is the one value check for resolved Secret and ConfigMap data.
func InjectorIdentity ¶ added in v0.15.0
func InjectorIdentity(ns v1.NamespaceName) auth.Identity
InjectorIdentity is the namespace-scoped developer identity a Function's secret reads are authorized as when no other is configured (ADR-0057 Decision 4): V1 is single-tenant per namespace, so the developer owns, and may read, its own namespace's secrets. The Function reconciler, the catalog service and the local API's /secret routes (ADR-0249) share it.
func IsReservedKey ¶
IsReservedKey reports whether an env key is reserved by the runtime shim contract (FUNCD_ARTIFACT/HANDLER/PORT/POOL_MANIFEST/PORTFILE, …): a FUNCD_-prefixed key may never be shadowed by resolved Secret/ConfigMap Data (ADR-0057, reserved-env-not-overridable). A prefix guard (not an explicit set) keeps every current and future reserved key protected. This is the single definition — the internal/function + internal/services/catalog copies are deleted (ADR-0092).
func MergeEnvGuarded ¶
MergeEnvGuarded merges src into dst, dropping (and logging via log, if non-nil) any key that IsReservedKey. It is the one guarded-merge reused by the Function reconciler, the CatalogService controller, and provider.ResolveEnv (ADR-0092). A nil log is tolerated (the drop is silent). It mutates only dst.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver reads decrypted Secrets and produces the env map the worker injects.
func NewResolver ¶
NewResolver builds the secrets resolver. Store + Authorizer are required.
func (*Resolver) ResolveEnv ¶
func (r *Resolver) ResolveEnv(ctx context.Context, id auth.Identity, ns v1.NamespaceName, names []string) (map[string]string, error)
ResolveEnv reads the named Secrets in ns (store-decrypted), PDP-authorized (read), and returns their merged Data as an env-var map for worker injection. A value env delivery cannot carry (EnvDataProblem: not valid UTF-8, or a NUL byte) is fault.Invalid; the first such key in sorted order is named.
Source Files
Directories