code: func (s *Server) CreateSecret(ctx context.Context, request *api.CreateSecretRequest) (*api.CreateSecretResponse, error) {
  	if err := validateSecretSpec(request.Spec); err != nil {
  		return nil, err
  	}
  
  	if request.Spec.Driver != nil { // Check that the requested driver is valid
  		if _, err := s.dr.NewSecretDriver(request.Spec.Driver); err != nil {
  			return nil, err
  		}
  	}
  
  	secret := secretFromSecretSpec(request.Spec) // the store will handle name conflicts
  	err := s.store.Update(func(tx store.Tx) error {
  		return store.CreateSecret(tx, secret)
  	})
  
  	switch err {
  	case store.ErrNameConflict:
  		return nil, status.Errorf(codes.AlreadyExists, "secret %s already exists", request.Spec.Annotations.Name)
  	case nil:
  		secret.Spec.Data = nil // clean the actual secret data so it's never returned
  		log.G(ctx).WithFields(logrus.Fields{
  			"secret.Name": request.Spec.Annotations.Name,
  			"method":      "CreateSecret",
  		}).Debugf("secret created")
  
  		return &api.CreateSecretResponse{Secret: secret}, nil
  	default:
  		return nil, err
  	}
  }
docs: // CreateSecret creates and returns a `CreateSecretResponse` with a `Secret` based
  // on the provided `CreateSecretRequest.SecretSpec`.
  // - Returns `InvalidArgument` if the `CreateSecretRequest.SecretSpec` is malformed,
  //   or if the secret data is too long or contains invalid characters.
  // - Returns an error if the creation fails.