// UpdateSecrets updates the secrets used by the remote enforcer
8400
func (s *RemoteEnforcer) UpdateSecrets(req rpcwrapper.Request, resp *rpcwrapper.Response) error {
	var err error
	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "updatesecrets auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()
	if s.enforcer == nil {
		return fmt.Errorf(resp.Status)
	}

	// If any error happens, cleanup everything on exit so that we can recover
	// by launcing a new remote.
	defer func() {
		if err != nil {
			s.cleanup()
		}
	}()

	payload := req.Payload.(rpcwrapper.UpdateSecretsPayload)
	s.secrets, err = secrets.NewSecrets(payload.Secrets)
	if err != nil {
		return err
	}

	err = s.enforcer.UpdateSecrets(s.secrets)

	return err
}
667396
func generateSecret(opts *Options) (*v1.Secret, error) {

	labels := generateLabels(map[string]string{"name": "tiller"})
	secret := &v1.Secret{
		Type: v1.SecretTypeOpaque,
		Data: make(map[string][]byte),
		ObjectMeta: metav1.ObjectMeta{
			Name:      secretName,
			Labels:    labels,
			Namespace: opts.Namespace,
		},
	}
	var err error
	if secret.Data["tls.key"], err = read(opts.TLSKeyFile); err != nil {
		return nil, err
	}
	if secret.Data["tls.crt"], err = read(opts.TLSCertFile); err != nil {
		return nil, err
	}
	if opts.VerifyTLS {
		if secret.Data["ca.crt"], err = read(opts.TLSCaCertFile); err != nil {
			return nil, err
		}
	}
	return secret, nil
}
737547
func (s *ContainerDefinition) SetSecrets(v []*Secret) *ContainerDefinition {
	s.Secrets = v
	return s
}
1374875
func (s *LogConfiguration) SetSecretOptions(v []*Secret) *LogConfiguration {
	s.SecretOptions = v
	return s
}
943960
func updateRcWithRetries(rcClient corev1client.ReplicationControllersGetter, namespace string, rc *corev1.ReplicationController, applyUpdate updateRcFunc) (*corev1.ReplicationController, error) {
	// Deep copy the rc in case we failed on Get during retry loop
	oldRc := rc.DeepCopy()
	err := retry.RetryOnConflict(retry.DefaultBackoff, func() (e error) {
		// Apply the update, then attempt to push it to the apiserver.
		applyUpdate(rc)
		if rc, e = rcClient.ReplicationControllers(namespace).Update(rc); e == nil {
			// rc contains the latest controller post update
			return
		}
		updateErr := e
		// Update the controller with the latest resource version, if the update failed we
		// can't trust rc so use oldRc.Name.
		if rc, e = rcClient.ReplicationControllers(namespace).Get(oldRc.Name, metav1.GetOptions{}); e != nil {
			// The Get failed: Value in rc cannot be trusted.
			rc = oldRc
		}
		// Only return the error from update
		return updateErr
	})
	// If the error is non-nil the returned controller cannot be trusted, if it is nil, the returned
	// controller contains the applied update.
	return rc, err
}
437648
func (c *FakeSecrets) Update(secret *corev1.Secret) (result *corev1.Secret, err error) {
	obj, err := c.Fake.
		Invokes(testing.NewUpdateAction(secretsResource, c.ns, secret), &corev1.Secret{})

	if obj == nil {
		return nil, err
	}
	return obj.(*corev1.Secret), err
}
451360
func (s *SecretService) PutSecrets(ctx context.Context, orgID influxdb.ID, m map[string]string) error {
	// PutSecrets operates on intersection between m and keys beloging to orgID.
	// We need to have read access to those secrets since it deletes the secrets (within the intersection) that have not be overridden.
	if err := authorizeReadSecret(ctx, orgID); err != nil {
		return err
	}

	if err := authorizeWriteSecret(ctx, orgID); err != nil {
		return err
	}

	err := s.s.PutSecrets(ctx, orgID, m)
	if err != nil {
		return err
	}

	return nil
}
424531
func (mr *MockTriremeControllerMockRecorder) UpdateSecrets(secrets interface{}) *gomock.Call {
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateSecrets", reflect.TypeOf((*MockTriremeController)(nil).UpdateSecrets), secrets)
}
350854
func (s *ProxyInfo) UpdateSecrets(token secrets.Secrets) error {
	s.Lock()
	s.Secrets = token
	s.Unlock()

	var allErrors string

	resp := &rpcwrapper.Response{}
	request := &rpcwrapper.Request{
		Payload: &rpcwrapper.UpdateSecretsPayload{
			Secrets: s.Secrets.PublicSecrets(),
		},
	}

	for _, contextID := range s.rpchdl.ContextList() {
		if err := s.rpchdl.RemoteCall(contextID, remoteenforcer.UpdateSecrets, request, resp); err != nil {
			allErrors = allErrors + " contextID " + contextID + ":" + err.Error()
		}
	}

	if len(allErrors) > 0 {
		return fmt.Errorf("unable to update secrets for some remotes: %s", allErrors)
	}

	return nil
}
365302
func (mr *MockSecretAPIClientMockRecorder) SecretUpdate(ctx, id, version, secret interface{}) *gomock.Call {
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SecretUpdate", reflect.TypeOf((*MockSecretAPIClient)(nil).SecretUpdate), ctx, id, version, secret)
}
322905
func (t *trireme) UpdateSecrets(secrets secrets.Secrets) error {
	for _, enforcer := range t.enforcers {
		if err := enforcer.UpdateSecrets(secrets); err != nil {
			zap.L().Error("unable to update secrets", zap.Error(err))
		}
	}
	return nil
}
898924
func (_m *APIClient) SecretUpdate(ctx context.Context, id string, version swarm.Version, secret swarm.SecretSpec) error {
	ret := _m.Called(ctx, id, version, secret)

	var r0 error
	if rf, ok := ret.Get(0).(func(context.Context, string, swarm.Version, swarm.SecretSpec) error); ok {
		r0 = rf(ctx, id, version, secret)
	} else {
		r0 = ret.Error(0)
	}

	return r0
}
1042601
func (s *InstanceCredentials) SetSecret(v string) *InstanceCredentials {
	s.Secret = &v
	return s
}
101925
func (c *Cluster) GetSecret(input string) (types.Secret, error) {
	var secret *swarmapi.Secret

	if err := c.lockedManagerAction(func(ctx context.Context, state nodeState) error {
		s, err := getSecret(ctx, state.controlClient, input)
		if err != nil {
			return err
		}
		secret = s
		return nil
	}); err != nil {
		return types.Secret{}, err
	}
	return convert.SecretFromGRPC(secret), nil
}
968905
func (s *SecurityConfig) UpdateTLSCredentials(certificate *tls.Certificate, issuerInfo *IssuerInfo) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	return s.updateTLSCredentials(certificate, issuerInfo)
}
1328471
func (s *remoteSite) updateCertAuthorities() error {
	// update main cluster cert authorities on the remote side
	// remote side makes sure that only relevant fields
	// are updated
	hostCA, err := s.localClient.GetCertAuthority(services.CertAuthID{
		Type:       services.HostCA,
		DomainName: s.srv.ClusterName,
	}, false)
	if err != nil {
		return trace.Wrap(err)
	}
	err = s.remoteClient.RotateExternalCertAuthority(hostCA)
	if err != nil {
		return trace.Wrap(err)
	}

	userCA, err := s.localClient.GetCertAuthority(services.CertAuthID{
		Type:       services.UserCA,
		DomainName: s.srv.ClusterName,
	}, false)
	if err != nil {
		return trace.Wrap(err)
	}
	err = s.remoteClient.RotateExternalCertAuthority(userCA)
	if err != nil {
		return trace.Wrap(err)
	}

	// update remote cluster's host cert authoritiy on a local cluster
	// local proxy is authorized to perform this operation only for
	// host authorities of remote clusters.
	remoteCA, err := s.remoteClient.GetCertAuthority(services.CertAuthID{
		Type:       services.HostCA,
		DomainName: s.domainName,
	}, false)
	if err != nil {
		return trace.Wrap(err)
	}

	if remoteCA.GetClusterName() != s.domainName {
		return trace.BadParameter(
			"remote cluster sent different cluster name %v instead of expected one %v",
			remoteCA.GetClusterName(), s.domainName)
	}
	err = s.localClient.UpsertCertAuthority(remoteCA)
	if err != nil {
		return trace.Wrap(err)
	}

	return s.compareAndSwapCertAuthority(remoteCA)
}
728984
func LoadSecrets(source map[string]interface{}, details composetypes.ConfigDetails) (map[string]composetypes.SecretConfig, error) {
	secrets := make(map[string]composetypes.SecretConfig)
	if err := Transform(source, &secrets); err != nil {
		return secrets, err
	}
	for name, secret := range secrets {
		obj, err := loadFileObjectConfig(name, "secret", composetypes.FileObjectConfig(secret), details)
		if err != nil {
			return nil, err
		}
		secretConfig := composetypes.SecretConfig(obj)
		secretConfig.Extras = loadExtras(name, source)
		secrets[name] = secretConfig
	}
	return secrets, nil
}