Documentation
¶
Overview ¶
Package secrets is the secrets delivery resolver (ADR-0022): it reads a function's bound Secret resources (auto-decrypted by the store's at-rest encryptor) and returns their data as an env-var map for worker injection — PDP-authorized (the secrets PEP): a workload's read asks secret::read for each Secret as that workload (ADR-0321), any other read one coarse question for the namespace. The injection is the function reconciler's secret gate (ADR-0057, internal/function): it resolves the bound Secrets through this resolver before any worker is provisioned and merges them into the worker's env (V1 delivers env only; tmpfs is V2). The at-rest encryptor lives in internal/secrets/aesgcm.
Index ¶
- func EnvDataProblem[V string | []byte](data map[string]V) (key, problem string)
- func EnvValueProblem(v string) string
- func InjectorIdentity(ns v1.NamespaceName) auth.Identity
- func IsReservedKey(k string) bool
- func MergeEnvGuarded(dst, src map[string]string, log *slog.Logger)
- func WorkloadIdentity(kind v1.Kind, ns v1.NamespaceName, name v1.ObjectName) auth.Identity
- type Deps
- type Resolver
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnvDataProblem ¶ added in v0.2.3
EnvDataProblem returns the first key of data, in sorted order, whose value EnvValueProblem rejects, with the problem; "" and "" if env delivery can carry every value. The sorted order keeps the error, and so a Function's Ready message, the same from one reconcile to the next.
func EnvValueProblem ¶ added in v0.2.2
EnvValueProblem says why v cannot be delivered as a worker env value, or returns "" if it can: a value that is not valid UTF-8 would reach the worker as U+FFFD, and exec rejects a NUL byte. It is the one value check for resolved Secret and ConfigMap data.
func InjectorIdentity ¶ added in v0.15.0
func InjectorIdentity(ns v1.NamespaceName) auth.Identity
InjectorIdentity is the namespace-scoped developer identity a Function's start check resolves its secrets as when no other is configured (ADR-0057 Decision 4): V1 is single-tenant per namespace, so the developer owns, and may read, its own namespace's secrets. A workload's own reads carry its principal on top of it (WorkloadIdentity, ADR-0321).
func IsReservedKey ¶
IsReservedKey reports whether an env key is reserved by the runtime shim contract (FUNCD_ARTIFACT/HANDLER/PORT/POOL_MANIFEST/PORTFILE, …): a FUNCD_-prefixed key may never be shadowed by resolved Secret/ConfigMap Data (ADR-0057, reserved-env-not-overridable). A prefix guard (not an explicit set) keeps every current and future reserved key protected. This is the single definition — the internal/function + internal/services/lake copies are deleted (ADR-0092).
func MergeEnvGuarded ¶
MergeEnvGuarded merges src into dst, dropping (and logging via log, if non-nil) any key that IsReservedKey. It is the one guarded-merge reused by the Function reconciler, the Lake controller, and provider.ResolveEnv (ADR-0092). A nil log is tolerated (the drop is silent). It mutates only dst.
func WorkloadIdentity ¶ added in v0.42.0
func WorkloadIdentity(kind v1.Kind, ns v1.NamespaceName, name v1.ObjectName) auth.Identity
WorkloadIdentity is a workload's reader identity (ADR-0321 Decision 3): the injector identity with the workload as its Cedar principal, so ResolveEnv and CheckRead ask secret::read for each Secret as that Function or Lake.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver reads decrypted Secrets and produces the env map the worker injects.
func NewResolver ¶
NewResolver builds the secrets resolver. Store + Authorizer are required.
func (*Resolver) CheckRead ¶ added in v0.42.0
func (r *Resolver) CheckRead(ctx context.Context, id auth.Identity, ns v1.NamespaceName, name string) error
CheckRead is the readiness check's question for one bound Secret (ADR-0321 Decision 4): may id's workload principal read it. It reads no Secret, so a missing one passes and the start check alone answers for it.
func (*Resolver) ResolveEnv ¶
func (r *Resolver) ResolveEnv(ctx context.Context, id auth.Identity, ns v1.NamespaceName, names []string) (map[string]string, error)
ResolveEnv reads the named Secrets in ns (store-decrypted), PDP-authorized (read), and returns their merged Data as an env-var map for worker injection. An identity that carries a principal asks secret::read for each Secret before its read (ADR-0321 Decision 3); one that carries none asks the coarse namespace question once. A value env delivery cannot carry (EnvDataProblem: not valid UTF-8, or a NUL byte) is fault.Invalid; the first such key in sorted order is named.
Source Files
Directories