code: func (s *storeImpl) getSecretFromDatastore(k secrets.Key) (secrets.Secret, error) {
  	// Switch to default namespace.
  	c, err := info.Namespace(s.ctx, "")
  	if err != nil {
  		panic(err) // should not happen, Namespace errors only on bad namespace name
  	}
  	c = ds.WithoutTransaction(c)
  
  	// Grab existing.
  	ent := secretEntity{ID: s.cfg.Prefix + ":" + string(k)}
  	err = ds.Get(c, &ent)
  	if err != nil && err != ds.ErrNoSuchEntity {
  		return secrets.Secret{}, transient.Tag.Apply(err)
  	}
  
  	// Autogenerate and put into the datastore.
  	if err == ds.ErrNoSuchEntity {
  		if s.cfg.NoAutogenerate {
  			return secrets.Secret{}, secrets.ErrNoSuchSecret
  		}
  		ent.Created = clock.Now(s.ctx).UTC()
  		if ent.Secret, err = s.generateSecret(); err != nil {
  			return secrets.Secret{}, transient.Tag.Apply(err)
  		}
  		if ent.SecretID, err = s.generateSecretID(ent.Created); err != nil {
  			return secrets.Secret{}, transient.Tag.Apply(err)
  		}
  		err = ds.RunInTransaction(c, func(c context.Context) error {
  			newOne := secretEntity{ID: ent.ID}
  			switch err := ds.Get(c, &newOne); err {
  			case nil:
  				ent = newOne
  				return nil
  			case ds.ErrNoSuchEntity:
  				return ds.Put(c, &ent)
  			default:
  				return err
  			}
  		}, nil)
  		if err != nil {
  			return secrets.Secret{}, transient.Tag.Apply(err)
  		}
  	}
  
  	return secrets.Secret{
  		Current: secrets.NamedBlob{
  			ID:   ent.SecretID,
  			Blob: ent.Secret,
  		},
  	}, nil
  }
docs: // getSecretImpl uses non-transactional datastore (txnBuf.GetNoTxn) to grab a
  // secret.