novox/hq
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ADR 0094: a module may hold several secrets from one provider; issue 069 resolved; design 24 amended

Browse Source
This commit is contained in:
jschoubben
2026-09-21 20:29:29 +02:00
parent a259d1292f
commit acc9824949
5 changed files with 78 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/24-the-secrets-vault.md
+7 -2
View File
@@ -4,6 +4,7 @@ status: implemented
code: [mesh-catalog, mesh-controller, mesh-host]
updated: 2026-09-21
decisions:
- 02-DECISIONS/0094-a-module-may-hold-several-secrets-from-one-provider.md
- 02-DECISIONS/0092-an-operator-delivers-a-pair-credential.md
- 02-DECISIONS/0085-a-secret-is-a-provision.md
- 02-DECISIONS/0031-the-control-plane-authenticates-nobody.md
@@ -48,8 +49,12 @@ A module that needs a secret for its own use requires a `secret` provision, exac
a database from the store. The vault generates the value — or takes custody of one an operator
delivered, through `secret accept … --provider`, which seals it to both ends and records the pair
as accepted ([ADR 0092](../../02-DECISIONS/0092-an-operator-delivers-a-pair-credential.md)) — and
the credential belongs to the consumer↔vault pair. An accepted pair is the one exception to what
follows: the mesh cannot make its replacement, so it is neither remade when a key changes nor
the credential belongs to the consumer↔vault pair. A module that needs several values names them
as local names under its `secrets` entry, and each is a pair of its own — keyed on the local
name, delivered as its own file, held at the vault as its own holder
([ADR 0094](../../02-DECISIONS/0094-a-module-may-hold-several-secrets-from-one-provider.md)).
*How it is checked:* manifest, resolver and inventory tests on two local names; the vault bed's
two-secret consumer. An accepted pair is the one exception to what follows: the mesh cannot make its replacement, so it is neither remade when a key changes nor
rotated; both are refused aloud, and accepting a new value is the rotation. *How it is checked:*
an inventory test accepts, reads back unchanged, and asserts the two refusals name the remedy. Because it is an ordinary pair
credential, **everything already built for pair credentials applies to it unchanged**: it rotates