zlayer_secrets/
lib.rs

1//! `ZLayer` Secrets Management
2//!
3//! Provides secure storage and retrieval of secrets for container workloads.
4//!
5//! ## Scoping
6//! Secrets are organized hierarchically:
7//! - Deployment-level: Shared by all services in a deployment
8//! - Service-level: Specific to a single service
9//!
10//! ## Syntax
11//! - `$S:secret-name` - Deployment-level secret
12//! - `$S:@service/secret-name` - Service-specific secret
13//! - `$secret://<env>/<KEY>` - Environment-scoped secret (requires an
14//!   [`EnvScopeProvider`] wired via [`SecretsResolver::with_env_resolver`])
15//! - `$secret://<env>/<KEY>/<field>` - With JSON field extraction
16
17pub mod cluster_dek;
18mod encryption;
19mod error;
20mod jwt;
21mod key_manager;
22mod provider;
23pub mod raft_sm;
24pub mod raft_store;
25pub mod sealed;
26mod types;
27
28#[cfg(feature = "persistent")]
29pub mod client_keys;
30
31#[cfg(feature = "persistent")]
32mod persistent;
33
34#[cfg(feature = "persistent")]
35pub mod credentials;
36
37#[cfg(feature = "persistent")]
38pub mod registry_credentials;
39
40#[cfg(feature = "persistent")]
41pub mod git_credentials;
42
43#[cfg(feature = "vault")]
44mod vault;
45
46pub use cluster_dek::ClusterDek;
47pub use encryption::EncryptionKey;
48pub use error::{Result, SecretsError};
49pub use jwt::{JwtSecretManager, ENV_JWT_SECRET};
50pub use key_manager::{load_or_generate_node_keypair, node_secrets_key_path, KeyManager};
51pub use provider::{EnvScopeProvider, SecretsProvider, SecretsResolver, SecretsStore};
52pub use raft_sm::SecretsState;
53pub use raft_store::{RaftSecretsHandle, RaftSecretsStore};
54pub use sealed::{RecipientPrivateKey, RecipientPublicKey, SealedError, SealedSecret};
55pub use types::{RotationResult, Secret, SecretMetadata, SecretRef, SecretScope};
56
57#[cfg(feature = "persistent")]
58pub use client_keys::{ActorKind, ClientKeyStore, ClientPublicKey, PersistentClientKeyStore};
59
60#[cfg(feature = "persistent")]
61pub use persistent::PersistentSecretsStore;
62
63#[cfg(feature = "persistent")]
64pub use credentials::CredentialStore;
65
66#[cfg(feature = "persistent")]
67pub use git_credentials::{GitCredential, GitCredentialKind, GitCredentialStore};
68
69#[cfg(feature = "persistent")]
70pub use registry_credentials::{RegistryAuthType, RegistryCredential, RegistryCredentialStore};
71
72#[cfg(feature = "vault")]
73pub use vault::VaultSecretsProvider;
zlayer_secrets/lib.rs

zlayer_secrets/
lib.rs
