Skip to main content

Interface: SecretStore

Defined in: packages/secrets/src/store.ts:27

The port through which a workload obtains a credential (chapter 24).

One workload, one secret, one read: there is deliberately no list, no put and no delete. Writing is the generator's and the operator's act, and a store that can enumerate is a store that can be browsed. Slice 0 has resolve and health and nothing else.

Whoever writes the second driver must preserve: a reference that names nothing is not_found (never an empty secret); a returned value is never logged by the driver; and permittedEnvironments states honestly where the driver may run, because configuration validation trusts it.

Properties​

driver​

readonly driver: string

Defined in: packages/secrets/src/store.ts:29

The driver's name, as it appears in configuration.

permittedEnvironments​

readonly permittedEnvironments: readonly ("staging" | "development" | "ci" | "integration" | "production")[]

Defined in: packages/secrets/src/store.ts:31

The environment classes this driver may run in.

Methods​

health()​

health(): Promise<SecretStoreHealth>

Defined in: packages/secrets/src/store.ts:43

Whether the store is usable. Never throws; a failure is status: 'down'.

Returns​

Promise<SecretStoreHealth>

resolve()​

resolve(reference): Promise<Secret<string>>

Defined in: packages/secrets/src/store.ts:40

Reads the secret a reference names.

Parameters​

reference​

string

secret://<namespace>/<name>.

Returns​

Promise<Secret<string>>

Throws​

Always a SecretError, never a raw I/O error, and its message says what the caller should do.