Enum SecretAccess 

pub enum SecretAccess {
    AllowAny,
    Workloads(Vec<WorkloadMatch>),
}

Who may be served a given cluster secret.

Stored alongside the ciphertext (yubaba’s SecretRecord) so the check rides on the record itself and is evaluated on the node at mount time — a rule checked only by the tool that authors a deploy is a lint, not a rule.

Default is Workloads(vec![]), which admits nobody. That is what makes the migration fail closed: a record serialized before this field existed deserializes (via #[serde(default)]) to an empty allow-list and is refused, rather than being implicitly granted to everyone.

Variants

AllowAny

Deliberately unrestricted: any workload that names this secret gets it.

This is the explicit escape hatch, never an implicit one. It has to be written into the record by whoever put the secret there, and it shows up in yah cloud secret ls as allow-any, so an unrestricted secret is an auditable choice rather than the silent default.

Workloads(Vec<WorkloadMatch>)

Only workloads matching one of these entries. An empty list admits nobody — see the type-level note on fail-closed defaulting.

Implementations

impl SecretAccess

pub fn workloads<I, S>(names: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Allow exactly the named workloads, in the singleton tenant/namespace.

pub fn admits(&self, consumer: &SecretConsumer) -> bool

Whether consumer may be served the secret this rule guards.

pub fn summary(&self) -> String

Short operator-facing rendering for yah cloud secret ls.

Trait Implementations

impl Clone for SecretAccess

fn clone(&self) -> SecretAccess

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretAccess

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretAccess

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretAccess

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SecretAccess

impl PartialEq for SecretAccess

fn eq(&self, other: &SecretAccess) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecretAccess

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecretAccess