Scoped secret store: wire callers to use ScopedProvider and UserProvider
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2.2k
- Forks
- 300
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 184
Description
Summary
Phase 4 of the scoped secret store implementation (#4192).
Update all callers to use the correct provider wrapper so system secrets are isolated in practice, not just in theory.
Work
- Registry auth (
pkg/registry/auth/): useCreateScopedSecretProvider(ScopeRegistry) - Workload auth (
pkg/auth/): useCreateScopedSecretProvider(ScopeWorkloads) - All user-facing entry points (CLI secret commands, API secrets routes, MCP tool server): use
CreateUserSecretProvider - Integration tests verifying isolation end-to-end
Dependencies
Depends on Phase 3. Must ship in the same PR as Phase 3 (migration infrastructure) — callers must not be updated before migration runs, and migration is useless without updated callers.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the callers in pkg/registry/auth/ and pkg/auth/, then locate the CLI secret commands, API secrets routes, and MCP tool server entry points. Coordinate this work with Phase 3 migration infrastructure, and add integration tests showing registry, workload, and user secrets remain isolated end-to-end.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, cli, security, testing
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100