secrets

Documentation

Overview

pkg/secrets

Shared secret lifecycle utilities used by both the runtime and the gateway.

These helpers live here rather than in pkg/runtime/runners/ because the gateway Apply API also needs secret existence checks and rotation logic for token secret management. Extracting them here avoids a gateway → runtime import.

Index

• func DeleteSecretForRotation(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) error
• func GenerationAnnotations(rotateAfter string) map[string]string
• func IsNotFoundErr(err error) bool
• func SecretExists(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) (bool, error)
• func SecretNeedsRotation(ctx context.Context, kube kubeclient.KubeClient, ...) (bool, error)

Functions

func DeleteSecretForRotation

func DeleteSecretForRotation(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) error

DeleteSecretForRotation deletes a Secret so it can be recreated with fresh values. Called when SecretNeedsRotation returns true. The next create call then generates new credentials and annotates with the current time.

func GenerationAnnotations

func GenerationAnnotations(rotateAfter string) map[string]string

GenerationAnnotations returns the annotations to add to a freshly generated Secret.

func IsNotFoundErr

func IsNotFoundErr(err error) bool

IsNotFoundErr returns true when err is a Kubernetes 404 Not Found error.

func SecretExists

func SecretExists(ctx context.Context, kube kubeclient.KubeClient, namespace, name string) (bool, error)

SecretExists checks whether a Secret with the given name exists in the namespace. Uses ResourceVersion: "0" to read from the API server watch cache (not etcd). Returns true if the secret exists, false on NotFound, error on API failure.

func SecretNeedsRotation

func SecretNeedsRotation(ctx context.Context, kube kubeclient.KubeClient, namespace, name, rotateAfter string) (bool, error)

SecretNeedsRotation returns true when the Secret exists but has exceeded its rotation threshold. Reads the generated-at annotation and compares to the declared rotateAfter duration.

Returns false (no rotation) when:

• rotateAfter is not set
• Secret does not exist
• Generated-at annotation is missing or unparseable → regenerate to be safe