Struct SecretConsumer 

pub struct SecretConsumer {
    pub workload: String,
    pub tenant: TenantId,
    pub namespace: NamespaceId,
    pub recipe: Option<RecipeIdentity>,
}

The identity a cluster-secret access rule is evaluated against: the requesting workload, as yubaba knows it at mount time.

Built from a WorkloadSpec via SecretConsumer::of. These three fields are the whole vocabulary because they are the whole identity available at the enforcement point — yubaba resolves secrets while holding a spec, with no cheers principal and no spec→principal mapping in reach.

Fields

workload: String

WorkloadSpec::name — the DNS-friendly workload name.

tenant: TenantId

WorkloadSpec::tenant — the isolation axis (W206).

namespace: NamespaceId

WorkloadSpec::namespace — the routing/naming axis (W206).

recipe: Option<RecipeIdentity>

The signed recipe this run was admitted as, when it carried a grant that verified (R555-F5). None for every ordinary service workload, and for any spec whose grant did not verify — see RecipeIdentity.

Implementations

impl SecretConsumer

pub fn of(spec: &WorkloadSpec) -> Self

The consumer identity of spec.

Carries no recipe identity: this constructor sees only the spec, and a recipe identity is a claim about a signature. Add one with SecretConsumer::admitted_as after verifying.

pub fn admitted_as(self, recipe: RecipeIdentity) -> Self

Attach the recipe identity a verified admission grant established.

pub fn workload(name: impl Into<String>) -> Self

A consumer in the singleton tenant/namespace — the shape every spec on a single-tenant fleet has. Convenience for tests and for authoring rules.

Trait Implementations

impl Clone for SecretConsumer

fn clone(&self) -> SecretConsumer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretConsumer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretConsumer

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SecretConsumer

impl PartialEq for SecretConsumer

fn eq(&self, other: &SecretConsumer) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecretConsumer

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecretConsumer