Module creds 

Pure credential/volume metadata over the CRD types: which Secrets a repository’s mover needs. Shared by the controller (envFrom projection, referent watches) and external tooling (kubectl kopiur doctor), so the “what credentials does this backend reference” answer cannot fork.

Structs

CredsSecretRef

A credential Secret a mover Job needs, with the namespace it is sourced from. namespace is the resolved source namespace (where the operator reads the Secret when projecting), not the Job’s namespace. None only when neither the reference nor the repository carries one — which projection treats as an actionable error (a ClusterRepository reference must pin a namespace).

Enums

WorkloadIdentityCloud

Which cloud IAM plane a workload-identity backend federates with. Drives the cloud-specific mover wiring (the Azure pod label; docs/messages naming the right SA annotation).

Constants

DEST_ENV_PREFIX

Env-var prefix under which a replication mover receives the destination backend’s credential Secret (envFrom.prefix). The source backend’s Secret is delivered unprefixed (kopia reads the plain names at repository connect and persists them), so the two sides never collide even when both are the same backend family with different keys (issue #200). The mover reads these back to authenticate the kopia repository sync-to destination.

Functions

backend_auth_secret_ref

The backend credentials Secret name for an object-store backend, if any.

backend_workload_identity

The backend’s workload-identity binding, if any, with its cloud plane.

mover_creds_secret_refs

The distinct credential Secrets a mover Job for backend + encryption needs as envFrom, each with its resolved source namespace: always the encryption-password Secret, plus the backend auth Secret when present and differently named. Deduped by name, order-stable (password first).

mover_creds_secrets

The distinct credential Secret names a mover Job for backend + encryption needs as envFrom: always the encryption-password Secret, plus the backend auth Secret when present and different. Deduped, order-stable (password first). The common single-secret setup (password + keys in one Secret) collapses to one entry. Names-only projection of mover_creds_secret_refs.