# orca.secrets

> A module of Orca's API.

Secrets a pipeline's runs get: `orca register --secret NAME=ID`.

NAME is the environment variable a run reads; ID is the secret's ID in
Secrets Manager, under `orca/`, which is all the stack's run role may read.
On the ec2 runner each instance's script reads them at start with its role
and exports them, so the driver, the head and the workers all have them, and
`ORCA_SECRETS` lists their names for `orca.logs.mask`, which keeps their
values out of every log orca writes. Postgres holds only the IDs.

## Functions

### `secret_problem`

```mojo
def secret_problem(spec: String) -> String
```

What's wrong with `NAME=ID`, or "" if nothing is.

### `secrets_json`

```mojo
def secrets_json(specs: List[String]) -> String
```

`NAME=ID`s as the JSON object Postgres keeps; "" for none.

### `parse_secrets`

```mojo
def parse_secrets(text: String) -> List[Tuple[String, String]]
```

Postgres's JSON object back as (NAME, ID) pairs.