Crate signet_client 

Rust client for signet.

Two connection modes mirror the two listeners signet exposes:

• dial_workload connects to the workload-facing SecretsService using SPIFFE mTLS, the same credential mechanism the signet server itself uses to authenticate callers. Gated behind the spiffe-workload feature — see the crate README for why, and for the fallback path (bring your own tonic::transport::Channel) when it’s disabled.
• dial_admin connects to the operator-facing AdminService/GitOpsService using a bearer token over TLS (or plaintext for loopback addresses), mirroring signet’s own signet CLI.

watch_bundle, acquire_lock, and wait_for_restart implement signet’s coordinated-restart protocol: a service can watch for its own bundle changes and safely serialize a fleet-wide restart via signet’s distributed restart lock, without a process host and without ever writing secrets to the environment or disk. See README.md’s “Coordinated restarts” section for the full design rationale, mirrored from the Go client.

encrypt_for_secret produces SOPS-compatible encrypted ciphertext for a secret value, since signetd never encrypts on a client’s behalf (SyncBundle/TriggerSync require content already be real SOPS ciphertext). Mirrors go/sops_encrypt.go.

Re-exports

pub use client::admin_client;

pub use client::dial_admin;

pub use client::gitops_client;

pub use client::read_ca_file;

pub use client::AdminChannel;

pub use client::ClientError;

pub use client::TokenInterceptor;

pub use restart::acquire_lock;

pub use restart::wait_for_restart;

pub use restart::watch_bundle;

pub use restart::Lock;

pub use restart::RestartError;

pub use sops_encrypt::encrypt_for_secret;

pub use sops_encrypt::SopsEncryptError;

Modules

admin

client

Connection helpers for talking to a signet server.

restart

Coordinated-restart support: watching for signet bundle changes and serializing a fleet-wide restart via signet’s distributed restart lock.

signet

Generated protobuf/tonic bindings for signet, from bytepunx/signet-proto. Run buf generate to regenerate src/gen.

sops_encrypt

Produces SOPS-compatible encrypted secret values.