secret_provider

Module: secret_provider

Contents

Modules

• cli
• http - Schema for an HTTP secret provider (type = "http").

Enums

• SecretProviderConfig - A custom secret-provider integration spec
• SecretProviderPatch - One entry in secret_providers

---

firma_config_schema::secret_provider::SecretProviderConfig

Enum

A custom secret-provider integration spec

One full-table entry in secret_providers, explicitly tagged by type so a CLI-only field (e.g. binary_name) and an HTTP-only field (e.g. host) can never be mixed on the same entry — an untagged CLI-vs-HTTP guess would also give worse parse errors for a malformed table than an explicit tag does.

Minimal CLI example (JSON output with { key, value } pairs):

[run.defaults]
secret_providers = [
    { type = "cli", binary_name = "mock-vault", provider_id = "mock-vault", credential_env_vars = [], matchers = [{ type = "sensitive_command", argv = ["secret", "list"], matcher = { type = "json", record_path = "$[*]", value_path = "$.value", name = { source = "path", path = "$.key" } } }] },
]

Minimal HTTP example:

[run.defaults]
secret_providers = [
    { type = "http", provider_id = "aws-secrets-manager", host = "secretsmanager.*.amazonaws.com", matchers = [{ type = "sensitive_command", path = "/GetSecretValue", matcher = { type = "json", record_path = "$", value_path = "$.SecretString", name = { source = "path", path = "$.Name" } } }] },
]

Variants:

• Cli(cli::CliSecretProviderConfig)
• Http(http::HttpSecretProviderConfig)

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> SecretProviderConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_config_schema::secret_provider::SecretProviderPatch

Enum

One entry in secret_providers

Either a bare string naming an existing built-in integration (e.g. "bws"), or a full table defining a new custom integration (CLI or HTTP). The outer dispatch is string-vs-table; the CLI-vs-HTTP distinction within the table form is resolved by [SecretProviderConfig]‘s own type tag.

Variants:

• Named(String)
• Custom(Box<SecretProviderConfig>)

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> SecretProviderPatch
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<D>(deserializer: D) -> Result<Self, <D as >::Error>

Module: cli

Module: http

Schema for an HTTP secret provider (type = "http").

Concrete, non-generic representation of exactly what an operator writes in firma.toml for an HTTP secret provider — either as a secret_providers entry under [run.defaults] / [run.profiles.<id>] ({ type = "http", provider_id = "...", host = "...", matchers = [...] }) which firma-run mirrors into [sidecar].http_secret_providers, or directly as [[sidecar.http_secret_providers]] in a sidecar config. firma-secret-provider converts these into its runtime HttpIntegrationSpec<SecretMatcher> type (generic over the matcher, and carrying the extraction behavior).