Crate zlayer_secrets 

ZLayer Secrets Management

Provides secure storage and retrieval of secrets for container workloads.

Scoping

Secrets are organized hierarchically:

• Deployment-level: Shared by all services in a deployment
• Service-level: Specific to a single service

Syntax

• $S:secret-name - Deployment-level secret
• $S:@service/secret-name - Service-specific secret
• $secret://<env>/<KEY> - Environment-scoped secret (requires an EnvScopeProvider wired via SecretsResolver::with_env_resolver)
• $secret://<env>/<KEY>/<field> - With JSON field extraction

Re-exports

pub use cluster_dek::ClusterDek;

pub use raft_sm::SecretsState;

pub use raft_store::RaftSecretsHandle;

pub use raft_store::RaftSecretsStore;

pub use sealed::RecipientPrivateKey;

pub use client_keys::ClientKeyStore;

pub use client_keys::PersistentClientKeyStore;

pub use credentials::CredentialStore;

pub use git_credentials::GitCredentialStore;

pub use registry_credentials::RegistryCredentialStore;

Modules

client_keys

Persistent storage for SDK / browser client public keys, used as recipients for sealed-box secret reads. Shares the secrets SQLite database with PersistentSecretsStore.

cluster_dek

Cluster Data Encryption Key (DEK) primitives for Phase 1 cluster-replicated secrets.

credentials

Credential store for API authentication.

git_credentials

Typed credential store for Git authentication (PAT or SSH key).

raft_sm

In-memory state and apply logic for the cluster secrets state machine.

raft_store

Cluster-replicated secrets store backed by openraft.

registry_credentials

Typed credential store for Docker/OCI registry authentication.

sealed

NaCl sealed-box wrapper for recipient-encrypted secret reads.

Structs

ClientPublicKey

A registered client public key bound to an actor.

EncryptionKey

Encryption key with secure memory handling.

GitCredential

Git authentication credential metadata.

JwtSecretManager

Manages the API daemon’s JWT signing secret.

KeyManager

Manages encryption keys for secret storage.

PersistentSecretsStore

Persistent secrets store backed by SQLite with encryption.

RecipientPublicKey

A 32-byte X25519 recipient public key.

RegistryCredential

Docker/OCI registry credential metadata.

RotationResult

Result of a secret rotation — records the version before and after the rotate call.

SealedSecret

A sealed secret payload — recipient-encrypted ciphertext plus identifying metadata.

Secret

A secure secret wrapper that provides memory safety guarantees.

SecretMetadata

Metadata associated with a stored secret.

SecretRef

A reference to a secret, parsed from the $S: prefix syntax.

SecretsResolver

Resolver for secret references in configuration values.

Enums

ActorKind

The kind of actor a registered client key belongs to.

GitCredentialKind

The kind of Git credential.

RegistryAuthType

Authentication method for a registry credential.

SealedError

Errors produced by sealed-box operations.

SecretScope

The scope of a secret - determines visibility and access.

SecretsError

Error type for secrets operations.

Constants

ENV_JWT_SECRET

Environment variable name for the operator-supplied JWT secret.

Traits

EnvScopeProvider

Resolves an environment name-or-id to the scope string used by the underlying SecretsStore.

SecretsProvider

Read-only secrets provider trait.

SecretsStore

Read-write secrets store trait.

Functions

load_or_generate_node_keypair

Load the existing node keypair from {base_dir}/node_secrets.key, or generate a new one and persist it (Unix mode 0600) if the file does not exist yet.

node_secrets_key_path

Path of the on-disk node X25519 keypair (raw 32-byte private key bytes, Unix mode 0600).

Type Aliases

Result

Convenience Result alias parameterised over SecretsError.