Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

The Six, and the Three Waiting

One page per store the agent speaks, each with the full pod YAML for every authentication method the store takes — copy, adjust names, apply. Everything is runnable; the consul flow is what the e2e harness runs on every pull request.

storespeaksauth methodsits page
ConsulKV over HTTPanonymous, token, kubernetes (login), jwtConsul
VaultKV v2token, kubernetes, approle, jwt, userpass, ldap, certVault
Config Serverthis project's own serverbearer tokenConfig Server
FirestoreGoogle Cloudmetadata-server (Workload Identity), access-token, emulatorFirestore
Gitany git hostanonymous, token, ssh keyGit
RedisRESPin the url (requirepass, ACL users)Redis

Common to all six:

  • The store's address rides dynamic-config.rs/endpoint — or endpoint-secret when the address itself carries a password.
  • The document's key rides dynamic-config.rs/key; the per-store syntax (mount/path, application/profile, a file path) is on the store's page.
  • Secret material rides Secrets, never annotations; the geography page has the one diagram.
  • A private CA is the same one annotation everywhere: dynamic-config.rs/ca-configmap.

Every pairing on these pages also exists as a ready-to-apply manifest in the repository's examples/ directory — thirteen files, each self-contained with its Secret placeholders.

etcd, NATS, S3 — 0.2.0

The other three store crates exist and work — from the engine, from the bindings — but their clients are async, and the 0.1 agent drives the blocking RemoteSource trait. The agent refuses them by name today:

--source etcd lands in 0.2.0 (its client is async); consul, vault,
config-server, firestore, git and redis are the 0.1 stores

Until then, the pattern that works today: put a config server in front. The server side speaks all nine stores including the async three, and the agent speaks the server. That indirection is also the answer when a fleet of pods should not each hold store credentials — the server holds them once.