workload_spec/
secrets.rs

1//! Pluggable secret resolver for [`crate::SecretRef`] values.
2//!
3//! The trait lives in `workload-spec` so consumers can construct specs and
4//! invoke the resolver without linking yubaba's containerd client. Yubaba
5//! provides the production impl in `crates/yah/yubaba/src/secrets.rs`.
6
7use std::path::PathBuf;
8
9use thiserror::Error;
10
11use crate::SecretRef;
12
13/// Errors returned by [`SecretResolver::resolve`].
14#[derive(Debug, Error)]
15pub enum SecretError {
16    /// The referenced secret file does not exist in the yubaba secret store.
17    #[error("secret not found at {path}")]
18    NotFound { path: PathBuf },
19
20    /// `SecretRef::Cluster` is reserved for V2 (raft-replicated cluster
21    /// secrets). V1 returns this error for any cluster secret reference.
22    #[error("cluster secrets are not implemented in V1 — raft replication is a follow-on")]
23    ClusterNotImplemented,
24
25    /// I/O error reading the secret file.
26    #[error("I/O error reading {path}: {source}")]
27    Io {
28        path: PathBuf,
29        #[source]
30        source: std::io::Error,
31    },
32}
33
34/// Resolves a [`SecretRef`] to its raw byte content.
35///
36/// The trait is defined here (in `workload-spec`) so callers don't need to
37/// link yubaba. Yubaba's `LocalFileResolver` reads from the per-machine secret
38/// store at `/var/lib/yah/yubaba/secrets/`. Tests use an inline `FakeResolver`.
39pub trait SecretResolver {
40    fn resolve(&self, r: &SecretRef) -> Result<Vec<u8>, SecretError>;
41}
workload_spec/secrets.rs

workload_spec/
secrets.rs
