Module secrets 

Pluggable secret resolver for crate::SecretRef values, plus the access rule that decides which workloads a cluster secret may be served to.

The trait lives in workload-spec so consumers can construct specs and invoke the resolver without linking yubaba’s containerd client. Yubaba provides the production impl in crates/yah/yubaba/src/secrets.rs.

Access rules (R706 / W294)

Before R706, SecretRef::Cluster { name } was a bearer reference: naming the secret was the entire authorization. SecretAccess closes that — it rides on the stored record, so the check happens on the node at mount time, where it cannot be routed around by a hand-rolled deploy.

The vocabulary is WorkloadSpec fields (SecretConsumer) rather than, say, cheers principals, because those are the only identity the enforcement point actually holds: at mount time yubaba has a WorkloadSpec and nothing else.

Fail-closed by construction: SecretAccess::default is an empty allow-list, which admits nobody. A legacy record written before this field existed deserializes to that default, so it is refused rather than granted.

Structs

RecipeIdentity

Who a remote run proved itself to be, cryptographically.

RecipeMatch

One entry in a SecretAccess::Recipes allow-list.

SecretConsumer

The identity a cluster-secret access rule is evaluated against: the requesting workload, as yubaba knows it at mount time.

WorkloadMatch

One entry in a SecretAccess::Workloads allow-list.

Enums

SecretAccess

Who may be served a given cluster secret.

SecretError

Errors returned by SecretResolver::resolve.

Traits

SecretResolver

Resolves a SecretRef to its raw byte content.