Scoped secret store: admin escape hatch for system key inspection
Open
Nobody has claimed this yet.
authentication
enhancement
go
- Dominant language
- Go
- Stars
- 2.2k
- Forks
- 300
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 184
Description
Summary
Phase 5 of the scoped secret store implementation (#4192).
Provides a privileged escape hatch for operators who need to inspect or delete system-managed secrets directly, without going through the scoped wrappers.
Work
--systemflag onthv secret listto include system-reserved keys in output--systemflag onthv secret deleteto allow deletion of a system-reserved key- Both flags require explicit opt-in and display a warning
- E2E tests covering flag behaviour
Dependencies
Depends on Phase 4. This is the last phase — the feature is complete once this ships.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Phase 4 implementation in #4192 and the entry points for thv secret list and thv secret delete. Add the explicitly opted-in --system behavior and warnings, then run the E2E tests covering both flags; done means system keys are included or deletable only with the flag.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authorization, cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100