A module may hold several secrets from one provider, each a pair of its own

secrets: maps a requirement to several files under local names. Each local name is
its own need, its own pair credential (the pair is keyed on it: migration 0027),
its own file on the consumer, its own holder at the provider (the identity with the
local name after it) and rotates apart from the others. The plain shape is
unchanged and every existing row is the credential it was (novox/hq 04-ISSUES/069,
ADR 0094).

cmd/mesh-controller/plan.go

@@ -122,7 +122,7 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 			}
 			continue
 		}
-		secret, err := inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From)
+		secret, err := inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
 		if err != nil {
 			// Said rather than skipped. A machine that resolves cleanly and receives no
 			// credential is one that will fail to authenticate at some later, less obvious
@@ -693,7 +693,7 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 		}
 		out = append(out, catalogue.Grant{
 			Provision: s.Name, Consumer: s.Consumer, At: onNetwork[s.Consumer],
-			From: from, Values: values, Slug: slug, Sealed: s.ForProvider})
+			From: from, Values: values, Slug: slug, Sealed: s.ForProvider, Local: s.Local})
 	}
 	return out, nil
 }

cmd/mesh-controller/rotate.go

@@ -83,11 +83,11 @@ func rotateCommand(ctx context.Context, args []string) error {
 	for _, h := range holders {
 		// The module, because a machine may hold several credentials for one provision and
 		// rotating "anchor's database password" now means rotating three of them.
-		fmt.Printf("  %s on %s, from %s\n", h.ConsumerModule, h.Consumer, h.Provider)
+		fmt.Printf("  %s on %s, from %s%s\n", h.ConsumerModule, h.Consumer, h.Provider, asLocal(h.Local))
 	}
 
 	for _, h := range holders {
-		if err := inv.RotateSecret(ctx, h.Provision, h.Consumer, h.ConsumerModule, h.Provider); err != nil {
+		if err := inv.RotateSecret(ctx, h.Provision, h.Consumer, h.ConsumerModule, h.Provider, h.Local); err != nil {
 			// Partly rotated, and said so plainly. What is gone is remade on the next push, so
 			// the remedy is to run this again rather than to repair anything — but a machine
 			// whose secret was discarded and not resent is holding a credential the provider is
@@ -115,3 +115,11 @@ func rotateCommand(ctx context.Context, args []string) error {
 		"changed cannot authenticate — `status` says who is still behind\n", len(machines))
 	return nil
 }
+
+// asLocal names the credential inside the consumer where it holds several (ADR 0094).
+func asLocal(local string) string {
+	if local == "" {
+		return ""
+	}
+	return " (as " + local + ")"
+}

cmd/mesh-controller/secret.go

@@ -52,6 +52,9 @@ func secretCommand(ctx context.Context, args []string) error {
 	provider := set.String("provider", "",
 		"the node providing <name>: the value becomes the PAIR credential between <module> on <node> "+
 			"and that provider, sealed to both — the vault's operator-delivered secret (ADR 0092)")
+	local := set.String("local", "",
+		"with --provider: the name the credential goes by inside <module>, where its manifest keeps "+
+			"several for <name> (ADR 0094)")
 	if err := set.Parse(flags); err != nil {
 		return err
 	}
@@ -79,10 +82,10 @@ func secretCommand(ctx context.Context, args []string) error {
 		// Into the pair, not into the module's own secrets: what the provider is asked to create
 		// and what the consumer reads are the same value, and neither end can be told a different
 		// one later without the other (novox/hq 04-ISSUES/070).
-		if err := open.inventory.AcceptSecretForPair(ctx, name, node, module, *provider, value); err != nil {
+		if err := open.inventory.AcceptSecretForPair(ctx, name, node, module, *provider, *local, value); err != nil {
 			return err
 		}
-		fmt.Printf("%s on %s now holds %q from %s, sealed to both machines.\n", module, node, name, *provider)
+		fmt.Printf("%s on %s now holds %q from %s%s, sealed to both machines.\n", module, node, name, *provider, asLocal(*local))
 		fmt.Printf("  the mesh cannot read it back, will not replace it with one of its own, and will not rotate it\n")
 		fmt.Printf("  run `push %s` and `push %s` to send it\n", *provider, node)
 		return nil
@@ -98,7 +101,7 @@ func secretCommand(ctx context.Context, args []string) error {
 	return nil
 }
 
-const secretUsage = "secret accept <node> <module> <name> [--from <file>] [--provider <node>]\n" +
+const secretUsage = "secret accept <node> <module> <name> [--from <file>] [--provider <node> [--local <name>]]\n" +
 	"secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>] [--provider <node>]\n" +
 	"secret export [--out <file>]"