On-demand, declarative-first secret management#14
On-demand, declarative-first secret management#14CertainLach wants to merge 32 commits intomasterfrom
Conversation
| } | ||
|
|
||
| #[tokio::main] | ||
| async fn main() -> Result<()> { |
There was a problem hiding this comment.
FIXME: Split, I would think about splitting my own deno implementation from things intended for my infra instead
CertainLach
force-pushed
the
push-xzkurnmtrspn
branch
from
89f2152 to
e987c6c
Compare
CertainLach
force-pushed
the
push-xzkurnmtrspn
branch
from
e987c6c to
f7d7283
Compare
| package.version = "0.1.0" | ||
| package.edition = "2024" | ||
| package.rust-version = "1.86.0" | ||
| package.rust-version = "1.89.0" |
There was a problem hiding this comment.
Is there a reason not to use the same version as in rust-toolchain.toml?
Even release-25.11 is currently at 1.91.1
There was a problem hiding this comment.
It was pinned for 25.05
| import: String, | ||
| // Magic values should have exactly two values to avoid pretty-printing | ||
| // as nix inline object value | ||
| __magic_marker: PhantomData<()>, |
There was a problem hiding this comment.
| __magic_marker: PhantomData<()>, | |
| #[serde(rename = "__magic_import")] | |
| _marker: PhantomData<()>, |
If I understand the intent correctly, there is no need to use weird field names if it' just part of ser-de
There was a problem hiding this comment.
Please elaborate
Yes, __magic_import name is to properly identify this name in nixlike serialization implementation
There was a problem hiding this comment.
This file is still full of todo!s
| gc_now(); | ||
| } | ||
| let config = Config(Arc::new(FleetConfigInternals { | ||
| // TODO: Load from somewhere |
There was a problem hiding this comment.
Is this to be addressed in this or the following PRs?
There was a problem hiding this comment.
It is not addressed anywhere. Feel free to add a CLI argument/ENV var for this, either way it should be handled using clap
| .await | ||
| .context("failed to copy generator to target host")?; | ||
|
|
||
| // TODO: Remove destdir after everything is done |
| }) | ||
| .unwrap(); | ||
| dbg!(&data); | ||
| // for v in 0..1000 { |
There was a problem hiding this comment.
Guess this can be dropped
| mkImpureSecretGenerator, | ||
| }: | ||
| mkImpureSecretGenerator { | ||
| # TODO: Escape prompt/part (preferrably just use env) to prevent shell injection |
There was a problem hiding this comment.
Too hard/idk if worth it considering that the only attack vector is the rogue fleet module which can do anything it wants anyway
2 participants
Secret management commands replaced with interactive generators, secret generation is now nix-driven