kubricate
Version:
A TypeScript framework for building reusable, type-safe Kubernetes infrastructure — without the YAML mess.
103 lines • 4.25 kB
TypeScript
import type { BaseProvider, SecretInjectionStrategy } from '@kubricate/core';
import type { BaseStack } from '../stack/BaseStack.js';
import type { FallbackIfNever } from '../types.js';
/**
* Extract only the strategy types allowed for this provider
*/
type ExtractAllowedKinds<Kinds extends SecretInjectionStrategy['kind'] = SecretInjectionStrategy['kind']> = Extract<SecretInjectionStrategy, {
kind: Kinds;
}>;
/**
* SecretInjectionBuilder provides a fluent API to define how a secret should be injected into a resource.
*
* @example
* injector.secrets('MY_SECRET')
* .inject({ kind: 'env', containerIndex: 0 })
* .intoResource('my-deployment'); // Optional
*/
export declare class SecretInjectionBuilder<Kinds extends SecretInjectionStrategy['kind'] = SecretInjectionStrategy['kind']> {
private readonly stack;
private readonly secretName;
private readonly provider;
private readonly ctx;
private strategy?;
private resourceIdOverride?;
/**
* The injected name override (used when `.forName(...)` is called).
*
* This will appear in the final manifest, such as an env var name or volume mount name.
* If not provided, the original secretName will be used.
*/
private targetName?;
constructor(stack: BaseStack, secretName: string, provider: BaseProvider, ctx: {
defaultResourceId?: string;
secretManagerId: number;
providerId: string;
});
/**
* Override the name to be injected into the target manifest.
*
* This is useful when the name used inside the resource (e.g., env var name)
* should differ from the registered secret name in the SecretManager.
*
* If not provided, the original secret name will be used.
*
* Example:
* .secrets('MY_SECRET').forName('API_KEY').inject({ kind: 'env' });
*
* Output:
* - name: API_KEY
* valueFrom:
* secretKeyRef:
* name: secret-application
* key: MY_SECRET
*
* @param name The name to use in the final manifest (e.g., environment variable name).
*/
forName(name: string): this;
/**
* Define how this secret should be injected into the Kubernetes resource.
*
* 👉 You can call `.inject(strategy)` with a specific strategy, or use `.inject()` with no arguments
* if the provider only supports **one** strategy kind (e.g. `'env'`).
*
* This method is **type-safe** and enforces allowed `kind` values per provider via TypeScript inference.
*
* @example
* // Explicit strategy:
* injector.secrets('APP_SECRET').inject('env', { containerIndex: 0 });
*
* // Implicit (default strategy):
* injector.secrets('APP_SECRET').inject(); // uses first provider-supported default
*/
inject(): this;
inject(kind?: ExtractAllowedKinds<Kinds>['kind'], strategyOptions?: Omit<FallbackIfNever<ExtractAllowedKinds<Kinds>, SecretInjectionStrategy>, 'kind'>): this;
/**
* Resolves a default injection strategy based on the `kind` supported by the provider.
* This allows `.inject()` to be used without arguments when the provider supports exactly one kind.
*
* Each kind has its own defaults:
* - `env` → `{ kind: 'env', containerIndex: 0 }`
* - `imagePullSecret` → `{ kind: 'imagePullSecret' }`
* - `annotation` → `{ kind: 'annotation' }`
*
* If the kind is unsupported for defaulting, an error is thrown.
*/
resolveDefaultStrategy(kind: SecretInjectionStrategy['kind']): SecretInjectionStrategy;
/**
* Explicitly define the resource ID that defined in the composer e.g. 'my-deployment', 'my-job' to inject into.
*/
intoResource(resourceId: string): this;
/**
* Resolve and register the final injection into the stack.
* Should be called by SecretsInjectionContext after the injection chain ends.
*/
resolveInjection(): void;
/**
* Resolve which resource ID to inject into.
* Priority: .intoResource(...) > setDefaultResourceId(...) > infer from provider.targetKind
*/
private resolveResourceId;
}
export {};
//# sourceMappingURL=SecretInjectionBuilder.d.ts.map