Crate zlayer_secrets 

ZLayer Secrets Management

Provides secure storage and retrieval of secrets for container workloads.

Scoping

Secrets are organized hierarchically:

• Deployment-level: Shared by all services in a deployment
• Service-level: Specific to a single service

Syntax

• $S:secret-name - Deployment-level secret
• $S:@service/secret-name - Service-specific secret
• $secret://<env>/<KEY> - Environment-scoped secret (requires an EnvScopeProvider wired via SecretsResolver::with_env_resolver)
• $secret://<env>/<KEY>/<field> - With JSON field extraction

Re-exports

pub use sealed::RecipientPrivateKey;

pub use sealed::RecipientPublicKey;

pub use sealed::SealedError;

pub use sealed::SealedSecret;

pub use client_keys::ActorKind;

pub use client_keys::ClientKeyStore;

pub use client_keys::ClientPublicKey;

pub use client_keys::PersistentClientKeyStore;

pub use credentials::CredentialStore;

pub use git_credentials::GitCredential;

pub use git_credentials::GitCredentialKind;

pub use git_credentials::GitCredentialStore;

pub use registry_credentials::RegistryAuthType;

pub use registry_credentials::RegistryCredential;

pub use registry_credentials::RegistryCredentialStore;

Modules

client_keys

Persistent storage for SDK / browser client public keys, used as recipients for sealed-box secret reads. Shares the secrets SQLite database with PersistentSecretsStore.

credentials

Credential store for API authentication.

git_credentials

Typed credential store for Git authentication (PAT or SSH key).

registry_credentials

Typed credential store for Docker/OCI registry authentication.

sealed

NaCl sealed-box wrapper for recipient-encrypted secret reads.

Structs

EncryptionKey

Encryption key with secure memory handling.

JwtSecretManager

Manages the API daemon’s JWT signing secret.

KeyManager

Manages encryption keys for secret storage.

PersistentSecretsStore

Persistent secrets store backed by SQLite with encryption.

RotationResult

Result of a secret rotation — records the version before and after the rotate call.

Secret

A secure secret wrapper that provides memory safety guarantees.

SecretMetadata

Metadata associated with a stored secret.

SecretRef

A reference to a secret, parsed from the $S: prefix syntax.

SecretsResolver

Resolver for secret references in configuration values.

Enums

SecretScope

The scope of a secret - determines visibility and access.

SecretsError

Constants

ENV_JWT_SECRET

Environment variable name for the operator-supplied JWT secret.

Traits

EnvScopeProvider

Resolves an environment name-or-id to the scope string used by the underlying SecretsStore.

SecretsProvider

Read-only secrets provider trait.

SecretsStore

Read-write secrets store trait.

Type Aliases

Result