Enum SecretAccess 

pub enum SecretAccess {
    AllowAny,
    Workloads(Vec<WorkloadMatch>),
    Recipes(Vec<RecipeMatch>),
}

Who may be served a given cluster secret.

Stored alongside the ciphertext (yubaba’s SecretRecord) so the check rides on the record itself and is evaluated on the node at mount time — a rule checked only by the tool that authors a deploy is a lint, not a rule.

Default is Workloads(vec![]), which admits nobody. That is what makes the migration fail closed: a record serialized before this field existed deserializes (via #[serde(default)]) to an empty allow-list and is refused, rather than being implicitly granted to everyone.

Variants

AllowAny

Deliberately unrestricted: any workload that names this secret gets it.

This is the explicit escape hatch, never an implicit one. It has to be written into the record by whoever put the secret there, and it shows up in yah cloud secret ls as allow-any, so an unrestricted secret is an auditable choice rather than the silent default.

Workloads(Vec<WorkloadMatch>)

Only workloads matching one of these entries. An empty list admits nobody — see the type-level note on fail-closed defaulting.

Recipes(Vec<RecipeMatch>)

Only runs of one of these signed recipes (R555-F5 / W235 §(c)).

The rule a dispatched build needs: its workload name is a per-run forge-<uuid> that no allow-list can name in advance, so SecretAccess::Workloads cannot express “the rusty-v8-musl build may read the R2 write key” and SecretAccess::AllowAny over-answers it by handing that key to anything that can reach the node.

Matching consumes a RecipeIdentity that only exists on the far side of a verified Ed25519 grant, so this is narrower than the workload rule, not a loophole in it: the requester has to be running argv the recipe author signed, on a node that pins the author’s key.

Implementations

impl SecretAccess

pub fn workloads<I, S>(names: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Allow exactly the named workloads, in the singleton tenant/namespace.

pub fn recipes<I, N, K>(entries: I) -> Self

where I: IntoIterator<Item = (N, K)>, N: Into<String>, K: Into<String>,

Whether consumer may be served the secret this rule guards. Allow exactly the named recipes, each signed by the given hex key.

pub fn admits(&self, consumer: &SecretConsumer) -> bool

pub fn summary(&self) -> String

Short operator-facing rendering for yah cloud secret ls.

Trait Implementations

impl Clone for SecretAccess

fn clone(&self) -> SecretAccess

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretAccess

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretAccess

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretAccess

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SecretAccess

impl PartialEq for SecretAccess

fn eq(&self, other: &SecretAccess) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecretAccess

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecretAccess