Struct GrantSecret 

pub struct GrantSecret {
    pub source: SecretRef,
    pub path: PathBuf,
    pub mode: u32,
}

One vault credential a grant admits, as a file inside the workload.

File-target only, on purpose — see the module docs on why env-target secret delivery is refused rather than admitted. mode is in the signed body because a secret readable by every uid in the container is a different grant from one readable by its owner.

Fields

source: SecretRef

Where yubaba reads the value from.

path: PathBuf

Absolute container path the value is mounted at.

mode: u32

File mode, octal.

Implementations

impl GrantSecret

pub fn of_mount(mount: &SecretMount) -> Option<Self>

The grant entry a spec’s mount corresponds to, or None when the mount is one no grant can admit (an env target).

pub fn describe(&self) -> String

Operator-facing rendering, for refusal messages only. Never parsed — the wire form is the four records AdmissionGrant::encode writes.

Trait Implementations

impl Clone for GrantSecret

fn clone(&self) -> GrantSecret

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GrantSecret

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for GrantSecret

impl PartialEq for GrantSecret

fn eq(&self, other: &GrantSecret) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for GrantSecret