Struct SecretConfig 

pub struct SecretConfig {
    pub schema_version: u32,
    pub name: String,
    pub vault_slot: String,
    pub groups: Vec<String>,
    pub description: Option<String>,
    pub encoding: SecretEncoding,
    pub access: SecretAccess,
    pub target: Option<SecretTargetDecl>,
}

A camp’s declaration of one cluster secret, from .yah/infra/secrets/<slug>.toml.

This is the authoring side of the fleet’s cluster-secret store: it names where the value lives in the camp (a fob vault slot), what the fleet should call it, and — the point of R706 — which workloads are allowed to mount it.

The declaration is not itself the enforcement point. yah cloud secret put reads this file, seals the vault value under the cluster KEK, and ships the ciphertext with its access rule into raft; yubaba’s ClusterResolver evaluates the rule on the node at mount time. Deleting this file does not revoke anything — the record in raft is the live authority. That asymmetry is deliberate: a rule that lived only in a git-tracked camp file would be trivially bypassed by anyone who could reach the fleet without the camp.

#:schema ../../schema/secret.toml.schema.json
schema_version = 2
name = "cheers/cloud-admin/verify-key"
vault_slot = "cheers-cloud-admin-verify-key"
groups = ["prod"]
description = "Ed25519 public key yah-cloud-admin verifies operator PASETOs with"

[access]
workloads = [{ workload = "yah-cloud-admin" }]

[target]
kind = "file"
path = "/run/secrets/cheers-verify.key"
mode = 0o400

Fields

schema_version: u32

name: String

Logical cluster-secret key, as SecretRef::Cluster { name } spells it — e.g. "tls/yah.dev/cert", "cheers/cloud-admin/verify-key". May contain /; the file stem is a filesystem-safe slug and carries no meaning.

vault_slot: String

The fob vault slot in this camp holding the plaintext value. Read by yah cloud secret put at ship time and never recorded anywhere else — in particular the value is not in this file, so the declaration is safe to commit.

groups: Vec<String>

The sovereign groups this secret belongs to (R911-F8). Required and non-empty; each entry must be a sovereign_group that some .yah/infra/machines/*.toml declares (SecretConfig::load checks).

Cluster secrets live per group in the fleet object store (secrets/<group>/<name>.sealed), so a declaration with no group has nowhere to land and nothing to be compared against. yah cloud secret put refuses a node whose /raft/status group is not listed here, and status counts a declaration only against nodes in one of these groups.

description: Option<String>

Human note for yah cloud secret ls. What this secret is and who minted it — the thing nobody remembers 6 months later.

encoding: SecretEncoding

How the vault slot’s text decodes into the bytes the consumer expects.

fob slots hold strings, but plenty of real secrets are binary — an Ed25519 key is exactly 32 raw bytes, and yah-cloud-admin rejects a key file of any other length. Without this field the only way to ship such a key would be to hope its bytes happened to be valid UTF-8, which for a random key they are not.

Defaults to SecretEncoding::Utf8 — the right answer for tokens, passwords, and PEM, which is most secrets.

access: SecretAccess

Who may mount it. Stamped onto the raft record verbatim.

Defaults to SecretAccess::default — the deny-all empty allow-list. A declaration that forgets this field produces a secret nobody can mount, which is the correct direction to fail in.

Three forms:

access = "allow_any"                              # explicit escape hatch

[access]                                          # named workloads
workloads = [{ workload = "yah-cloud-admin" }]

[access]                                          # signed recipes (R555-F5)
recipes = [{ recipe = "rusty-v8-musl", key = "3d40…" }]

Use the recipes form for a credential a dispatched build needs (the R2 write key, the cosign signing key). A remote QED run’s workload name is a fresh forge-<uuid> every time, so workloads cannot name it and allow_any over-answers — see W235 §Seam (c) secret scoping. key is the hex Ed25519 public key from the recipe’s [admission] block.

target: Option<SecretTargetDecl>

Advisory: the mount shape a consuming workload should declare. Not enforced — yubaba honours whatever the WorkloadSpec asks for — but it lets yah cloud secret put print the exact SecretMount to paste, so the consumer and the declaration can’t drift on path or mode.

Implementations

impl SecretConfig

pub fn load(path: &Path, sovereign_groups: &[&str]) -> Result<Self>

Parse a single .yah/infra/secrets/<slug>.toml.

sovereign_groups is the camp’s group vocabulary (CloudConfig::declared_sovereign_groups); every entry in groups must be one of them.

pub fn load_dir( dir: &Path, sovereign_groups: &[&str], ) -> Result<BTreeMap<String, Self>>

Load every declaration in dir, keyed by logical secret name. A missing directory is an empty map (a camp with no cluster secrets is normal).

Two files declaring the same name is a hard error, not a last-writer- wins merge: they would race to define the access rule for one record, and whichever lost would look correct in git while being inert on the fleet.

pub fn validate(&self) -> Result<()>

Reject declarations that would produce an unusable or dangerous record.

Structural only: whether each of groups names a real sovereign group needs the camp’s machines, so that half is Self::validate_groups.

pub fn validate_groups(&self, sovereign_groups: &[&str]) -> Result<()>

Every entry in groups must be a sovereign group the camp’s machines declare. A typo would otherwise produce a declaration no node ever matches, which put would refuse everywhere and status would never count, without either one saying why.

Trait Implementations

impl Clone for SecretConfig

fn clone(&self) -> SecretConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.