Validate secret slots through the system SDK - #1010
Open
tlm wants to merge 6 commits into
Open
Conversation
tlm
force-pushed
the
system-sdk-secret-provider
branch
from
August 31, 2026 03:53
c227c45 to
a1f0c0a
Compare
Add a SlotInfo.CompareByName helper for deterministic slot ordering by name. This provides a reusable comparator for slices.SortFunc call sites.
The initial secret provider is implemented by the built-in system SDK, so validation of its provider-specific slot metadata belongs with the system SDK rather than the generic secret interface. Add a system SDK slot preparation entry point that verifies slot ownership and dispatches to interface-specific preparation logic. Leave interfaces without system-specific preparation unchanged so existing system slots continue to behave as before. Add secret slot preparation that validates the supported attributes and collection keys, requires at least one string-valued lookup attribute, and defaults an omitted collection to "default". Cover dispatch, validation, and normalization behavior with focused tests.
Secret slot metadata is currently provided only by the built-in system SDK. Keep the secret interface responsible for selecting the supported provider, but avoid embedding system-specific validation rules in the generic interface implementation. Reject secret slots owned by non-system SDKs, then delegate supported slots to the system SDK preparation entry point. This keeps interface policy and provider routing in the builtin while leaving provider-specific validation and normalization with the system SDK implementation. Add integration tests covering provider rejection and delegation, including default collection normalization.
Secret slot validation was initially placed in the system SDK package to reflect that the system SDK provides the host keyring integration. This introduced a separate slot preparation dispatcher solely to route secret slots from the builtin interface into provider-specific validation. Builtin interfaces already own the validation and normalization of their plug and slot attributes. Move the secret schema checks into the secret interface to follow that established structure and keep the complete interface contract in one place. Continue restricting secret slots to the system SDK, validating lookup attributes and collection values, and defaulting an omitted collection to "default". Move the corresponding tests into the builtin interface package and remove the now-unused system SDK slot preparation layer.
tlm
force-pushed
the
system-sdk-secret-provider
branch
from
September 1, 2026 00:36
a1f0c0a to
d057791
Compare
dmitry-lyfar
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add validation and normalization for secret slots to the built-in secret interface.
Secret slots:
attributesandcollection."default".The validation was initially implemented as provider-specific preparation under
internal/sdk/system. It now lives directly in the secret builtin to match the established pattern where interfaces own validation and normalization of their plug and slot attributes.The
SlotSanitizercontract is also clarified to explicitly permit attribute normalization and defaults while prohibiting changes to slot identity.Design decisions
The secret builtin owns the complete secret slot contract. This keeps its base declaration, provider restriction, attribute validation, and normalization together and makes its implementation consistent with the other built-in interfaces.
Secret slots remain restricted to the system SDK because it is currently the only supported secret provider.
Testing
go test ./internal/interfaces/builtin ./internal/sdk/systemSelf-review quick check
Docs