secret_problem
def secret_problem(spec: String) -> StringWhat's wrong with NAME=ID, or "" if nothing is.
orca.secrets
Secrets a pipeline's runs get: orca register --secret NAME=ID.
NAME is the environment variable a run reads; ID is the secret's ID in
Secrets Manager, under orca/, which is all the stack's run role may read.
On the ec2 runner each instance's script reads them at start with its role
and exports them, so the driver, the head and the workers all have them, and
ORCA_SECRETS lists their names for orca.logs.mask, which keeps their
values out of every log orca writes. Postgres holds only the IDs.
Functions
secrets_json
def secrets_json(specs: List[String]) -> StringNAME=IDs as the JSON object Postgres keeps; "" for none.
parse_secrets
def parse_secrets(text: String) -> List[Tuple[String, String]]Postgres's JSON object back as (NAME, ID) pairs.