Documentation
¶
Overview ¶
Package secrets wires `w17ctl secrets <leaf>` — the age-tier ("optional key") production-secrets surface. `init` mints a project age keypair (encrypted when the key is present, plain otherwise); `encrypt` turns a plain `.secrets` into a committable `.secrets.age`; `backend` sets the deploy-boundary materialiser. The runtime resolution chain (sdk/go/service/secret) consumes the result. Spec: docs/specs/secrets/production-secrets.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BackendCmd ¶
type BackendCmd struct {
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file."`
Console string `` /* 176-byte string literal not displayed */
SopsFile string `` /* 128-byte string literal not displayed */
Name string `arg:"" name:"name" help:"Materialiser: plain | sops | eso | vault | cloud-csi."`
}
BackendCmd implements `w17ctl secrets backend <name>`. The lock mutation (secrets.backend) goes through the console's EditLock (Block 2 §8.2 — the console owns the lock); the sops side-file render stays client-side.
func (*BackendCmd) Run ¶
func (c *BackendCmd) Run() error
type Cmd ¶
type Cmd struct {
Init InitCmd `` /* 242-byte string literal not displayed */
Encrypt EncryptCmd `` /* 159-byte string literal not displayed */
Backend BackendCmd `` /* 273-byte string literal not displayed */
}
Cmd is the parent of `w17ctl secrets <leaf>`.
type EncryptCmd ¶
type EncryptCmd struct {
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file."`
Console string `` /* 176-byte string literal not displayed */
File string `arg:"" name:"file" help:"Plain secrets file to encrypt (e.g. app-business/.secrets). Output is <file>.age."`
}
EncryptCmd implements `w17ctl secrets encrypt <file>`. Read-only on the lock: the age recipients come from the console's DescribeLock (Block 2 §8.2); the file encryption stays client-side.
func (*EncryptCmd) Run ¶
func (c *EncryptCmd) Run() error
type InitCmd ¶
type InitCmd struct {
LockPath string `name:"lock" placeholder:"PATH" default:"w17/lock.yaml" help:"Path to the lock file."`
Console string `` /* 176-byte string literal not displayed */
KeyFile string `` /* 173-byte string literal not displayed */
Force bool `` /* 170-byte string literal not displayed */
}
InitCmd implements `w17ctl secrets init`.
Source Files