Documentation
¶
Overview ¶
Package secret materializes recipe secret outputs into Radius-managed Radius.Security/secrets resources so that secret values are never persisted on the owning resource. Consumers bind to the managed secret by name via a container's env valueFrom.secretKeyRef.
Index ¶
Constants ¶
const (
// SecuritySecretsResourceType is the fully-qualified resource type of the managed secret.
SecuritySecretsResourceType = "Radius.Security/secrets"
)
Variables ¶
This section is empty.
Functions ¶
func ManagedSecretName ¶
ManagedSecretName derives the deterministic name of the managed Radius.Security/secrets resource for an owner resource. It combines the owner's name with a short hash of the owner's fully-qualified resource ID so that owners that share a name but differ in resource type or scope — which is allowed within a single resource group — never collide on the same managed secret. The result is a valid RFC 1123 label (lowercase, `[a-z0-9-]`, bounded to 63 characters) so it is always a legal Kubernetes object name. The name is stable for a given owner, so Materialize and Delete derive the same value.
Types ¶
type Materializer ¶
type Materializer interface {
// Materialize creates or updates the managed secret for the owner described by req and returns its
// identity. It is idempotent: the managed secret name is derived deterministically from the owner.
Materialize(ctx context.Context, req Request) (Result, error)
// Delete removes the managed secret backing the given owner resource. Deleting a non-existent managed
// secret is not an error.
Delete(ctx context.Context, ownerResourceID string) error
}
Materializer creates, updates and deletes the Radius.Security/secrets resource that backs a resource's declared recipe secret outputs.
func NewMaterializer ¶
func NewMaterializer(armClientOptions *arm.ClientOptions) Materializer
NewMaterializer creates a Materializer that talks to UCP using the provided ARM client options.
type Request ¶
type Request struct {
// OwnerResourceID is the fully-qualified resource ID of the resource that declared the secrets block.
OwnerResourceID string
// EnvironmentID is the owner's environment ID, copied onto the managed secret.
EnvironmentID string
// ApplicationID is the owner's application ID, copied onto the managed secret when non-empty.
ApplicationID string
// Data maps declared secret keys to their plaintext values. The values are only ever held in memory
// and passed through to the managed secret's sensitive input; they are never persisted on the owner.
Data map[string]string
}
Request describes the managed secret to create or update for an owner resource.
type Result ¶
type Result struct {
// ID is the fully-qualified resource ID of the managed Radius.Security/secrets resource.
ID string
// Name is the name of the managed Radius.Security/secrets resource. Consumers reference this via a
// container env valueFrom.secretKeyRef.secretName.
Name string
}
Result identifies the managed secret backing an owner resource.
Source Files