Skip to main content

zlayer_secrets/
lib.rs

1//! `ZLayer` Secrets Management
2//!
3//! Provides secure storage and retrieval of secrets for container workloads.
4//!
5//! ## Scoping
6//! Secrets are organized hierarchically:
7//! - Deployment-level: Shared by all services in a deployment
8//! - Service-level: Specific to a single service
9//!
10//! ## Syntax
11//! - `$S:secret-name` - Deployment-level secret
12//! - `$S:@service/secret-name` - Service-specific secret
13//! - `$secret://<env>/<KEY>` - Environment-scoped secret (requires an
14//!   [`EnvScopeProvider`] wired via [`SecretsResolver::with_env_resolver`])
15//! - `$secret://<env>/<KEY>/<field>` - With JSON field extraction
16
17mod encryption;
18mod error;
19mod jwt;
20mod key_manager;
21mod provider;
22pub mod sealed;
23mod types;
24
25#[cfg(feature = "persistent")]
26pub mod client_keys;
27
28#[cfg(feature = "persistent")]
29mod persistent;
30
31#[cfg(feature = "persistent")]
32pub mod credentials;
33
34#[cfg(feature = "persistent")]
35pub mod registry_credentials;
36
37#[cfg(feature = "persistent")]
38pub mod git_credentials;
39
40#[cfg(feature = "vault")]
41mod vault;
42
43pub use encryption::EncryptionKey;
44pub use error::{Result, SecretsError};
45pub use jwt::{JwtSecretManager, ENV_JWT_SECRET};
46pub use key_manager::KeyManager;
47pub use provider::{EnvScopeProvider, SecretsProvider, SecretsResolver, SecretsStore};
48pub use sealed::{RecipientPrivateKey, RecipientPublicKey, SealedError, SealedSecret};
49pub use types::{RotationResult, Secret, SecretMetadata, SecretRef, SecretScope};
50
51#[cfg(feature = "persistent")]
52pub use client_keys::{ActorKind, ClientKeyStore, ClientPublicKey, PersistentClientKeyStore};
53
54#[cfg(feature = "persistent")]
55pub use persistent::PersistentSecretsStore;
56
57#[cfg(feature = "persistent")]
58pub use credentials::CredentialStore;
59
60#[cfg(feature = "persistent")]
61pub use git_credentials::{GitCredential, GitCredentialKind, GitCredentialStore};
62
63#[cfg(feature = "persistent")]
64pub use registry_credentials::{RegistryAuthType, RegistryCredential, RegistryCredentialStore};
65
66#[cfg(feature = "vault")]
67pub use vault::VaultSecretsProvider;