Module creds 

Pure credential/volume metadata over the CRD types: which Secrets a repository’s mover needs. Shared by the controller (envFrom projection, referent watches) and external tooling (kubectl kopiur doctor), so the “what credentials does this backend reference” answer cannot fork.

Structs

CredsSecretRef

A credential Secret a mover Job needs, with the namespace it is sourced from. namespace is the resolved source namespace (where the operator reads the Secret when projecting), not the Job’s namespace. None only when neither the reference nor the repository carries one — which projection treats as an actionable error (a ClusterRepository reference must pin a namespace).

Enums

WorkloadIdentityCloud

Which cloud IAM plane a workload-identity backend federates with. Drives the cloud-specific mover wiring (the Azure pod label; docs/messages naming the right SA annotation).

Constants

DEST_ENV_PREFIX

Env-var prefix under which a replication mover receives the destination backend’s credential Secret (envFrom.prefix). The source backend’s Secret is delivered unprefixed (kopia reads the plain names at repository connect and persists them), so the two sides never collide even when both are the same backend family with different keys (issue #200). The mover reads these back to authenticate the kopia repository sync-to destination.

DEST_KOPIA_PASSWORD_ENV

Env var carrying the destination repository’s encryption password (KOPIA_PASSWORD) into a snapshot-replication mover. The source password rides the plain KOPIA_PASSWORD (persisted into the source kopia config at connect), so the destination’s must arrive under a distinct name — the mover reads this and re-exports it as KOPIA_PASSWORD for the destination client only. Deliberately NOT {DEST_ENV_PREFIX}KOPIA_PASSWORD mechanical prefixing: the controller delivers it as a single valueFrom.secretKeyRef env var built from the RESOLVED destination credentials (which may be a projected copy with a different Secret name), not via an envFrom prefix remap.

MAX_CREDS_IDX

The highest per-repository credential-Secret index mover_creds_secret_refs can ever yield: the encryption-password Secret (idx 0) plus, only when it is differently named, the backend’s auth Secret (idx 1). Every consumer that derives per-index resource names (projected copies, server mirrors) bounds its reap walks with this.

SEED_ENV_PREFIX

Env-var prefix under which a seeding bootstrap mover receives the seed SOURCE’s credential Secret (envFrom.prefix), the mirror image of DEST_ENV_PREFIX.

SEED_KOPIA_PASSWORD_ENV

Env var carrying the seed SOURCE repository’s encryption password into a seeding bootstrap mover, the mirror image of DEST_KOPIA_PASSWORD_ENV.

Functions

backend_auth_secret_ref

The backend credentials Secret name for an object-store backend, if any.

backend_workload_identity

The backend’s workload-identity binding, if any, with its cloud plane.

mover_creds_secret_refs

The distinct credential Secrets a mover Job for backend + encryption needs as envFrom, each with its resolved source namespace: always the encryption-password Secret, plus the backend auth Secret when present and differently named. Deduped by name, order-stable (password first).

mover_creds_secrets

The distinct credential Secret names a mover Job for backend + encryption needs as envFrom: always the encryption-password Secret, plus the backend auth Secret when present and different. Deduped, order-stable (password first). The common single-secret setup (password + keys in one Secret) collapses to one entry. Names-only projection of mover_creds_secret_refs.