Documentation
¶
Overview ¶
Package secrets is the secrets delivery resolver (ADR-0022): it reads a function's bound Secret resources (auto-decrypted by the store's at-rest encryptor) and returns their data as an env-var map for worker injection — PDP-authorized (the secrets PEP). The actual env/tmpfs injection into the running worker is a P-M-successor's job; this is the delivery contract. The at-rest encryptor lives in internal/secrets/aesgcm.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsReservedKey ¶
IsReservedKey reports whether an env key is reserved by the runtime shim contract (FUNCD_ARTIFACT/HANDLER/PORT/POOL_MANIFEST/PORTFILE, …): a FUNCD_-prefixed key may never be shadowed by resolved Secret/ConfigMap Data (ADR-0057, reserved-env-not-overridable). A prefix guard (not an explicit set) keeps every current and future reserved key protected. This is the single definition — the internal/function + internal/services/catalog copies are deleted (ADR-0092).
func MergeEnvGuarded ¶
MergeEnvGuarded merges src into dst, dropping (and logging via log, if non-nil) any key that IsReservedKey. It is the one guarded-merge reused by the Function reconciler, the CatalogService controller, and provider.ResolveEnv (ADR-0092). A nil log is tolerated (the drop is silent). It mutates only dst.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver reads decrypted Secrets and produces the env map the worker injects.
func NewResolver ¶
NewResolver builds the secrets resolver. Store + Authorizer are required.
func (*Resolver) ResolveEnv ¶
func (r *Resolver) ResolveEnv(ctx context.Context, id auth.Identity, ns v1.NamespaceName, names []string) (map[string]string, error)
ResolveEnv reads the named Secrets in ns (store-decrypted), PDP-authorized (read), and returns their merged Data as an env-var map for worker injection.
Source Files
Directories