mesh-sdk/go/catalogue/secrets_into_files.go

package catalogue

// SecretsInEnvironment is the key a container carries to say, out loud, that a secret reaches
// its process through the environment — and why.
//
// **A secret reaches a process as a file** (novox/hq ADR 0086). The mesh seals a value to the
// machine and the host writes it at 0600; a container that then reads it from an env-file hands
// it to the runtime, which prints it in `docker inspect` and keeps it in the process's /proc entry
// for anything on the machine that can talk to the runtime (novox/hq 04-ISSUES/041). Some software
// reads its configuration from the environment and nothing else, and for that this key exists: a
// reason, on the container, so a reader can tell from the manifest which secrets are exposed that
// way and which are not. Without it, a container whose env-file carries a secret is refused.
//
// Catalogue-level: the host never sees this key.
const SecretsInEnvironment = "secrets-in-environment"

func join(names []string) string {
	switch len(names) {
	case 1:
		return names[0]
	case 2:
		return names[0] + " or " + names[1]
	}
	out := ""
	for i, n := range names[:len(names)-1] {
		if i > 0 {
			out += ", "
		}
		out += n
	}
	return out + " or " + names[len(names)-1]
}