secrets

type Inject struct {
	// Env is the name of an environment variable to set on the child
	// process. The value will be the secret's Shadow placeholder.
	Env string

	// File is an absolute path inside the child's filesystem where the
	// Shadow placeholder will be written. Parent directories are
	// created with 0700; the file itself is mode 0400 owned by the
	// child's uid (the runtime owns those decisions).
	File string
}

type PortSpec struct {
	Port     uint16
	Protocol uint8 // unix.IPPROTO_TCP or unix.IPPROTO_UDP
}

type Ref struct {
	OwnerID string
	Keys    []string
}

type Secret struct {
	// OwnerID identifies the logical producer of this secret. Used for
	// 8-byte-prefix collision tracking when generating shadows; two
	// entries with the same OwnerID are treated as siblings (a shadow
	// being regenerated for the same owner is not a collision with its
	// own previous value).
	OwnerID string

	// Key is a sub-identifier within an owner: a Kubernetes Secret can
	// have multiple data keys; YAML entries today have one key per
	// entry. The (OwnerID, Key) pair is unique within a snapshot.
	Key string

	// Real is the real secret value. The kernel rewrites Shadow → Real
	// in TLS writes that match the Host/IP/Port filters below.
	Real string

	// Shadow is the placeholder the application sees and the BPF map
	// keys off (the first 8 bytes are the lookup key).
	Shadow string

	// Host is a hostname filter. If non-empty, the rewrite happens only
	// on connections made to the hostname's virtual IP, which kloak hands
	// the pod in DNS answers for it. Empty means any host.
	Host string

	// IP is an alternative to Host: a literal destination IP, matched
	// against the address the connection was made to (after the virtual
	// IP redirect), with no DNS involved. Mutually exclusive with Host (k8s
	// adapter populates this when Host parses as a literal IP).
	IP net.IP

	// Port is a TCP/UDP port filter. 0 means any port.
	Port uint16

	// Protocol is unix.IPPROTO_TCP / IPPROTO_UDP, or 0 for any.
	Protocol uint8

	// Inject describes how the standalone `kloak run` runtime should
	// surface this secret's *shadow* value to a child process. The k8s
	// adapter leaves this zero — Kubernetes Pods already get their
	// secret values through the cluster's own injection mechanisms
	// (volume mounts, env vars rewritten by the webhook), so the
	// data-plane sync code never reads this field. The YAML / dotenv /
	// host-env Sources for `kloak run` set it from the user's config.
	Inject Inject
}

type ShadowGenerator struct {
	// contains filtered or unexported fields
}

type Source interface {
	Snapshot(ctx context.Context) ([]Secret, error)
}