Module sink 

Credential sinks — where the App credentials get written after creation.

Stdout and File exist for testing/dry-run. Sops is the canonical sink for pleme-io GitOps clusters: renders a K8s Secret YAML matching the pleme-arc-controller chart’s expected shape, then runs sops --encrypt --in-place on it. Akeyless is a stub for the future migration.

Functions

emit_helmrelease_values

Print a HelmRelease values stub for pleme-arc-controller consuming these credentials. Useful for double-checking the chart wiring.

load_credentials

Load credentials from a file (plaintext YAML — only useful for re-loading after a File sink). For SOPS files, decrypt with sops -d before reading.

parse_cli_sink

Parse the CLI’s --sink "kind:..." shorthand into a SinkConfig.

write

Write credentials to the configured sink.