Module secret 

The secret front door — interpolation tokens that let a config name a credential without ever containing one.

Secrets come from the environment, a mounted file, or an interactive startup prompt: never from the config file and never into a log line. This module reads a credential from a mounted file (a Kubernetes Secret volume), trims the trailing newline kubelet leaves on a projected file, and resolves the two interpolation tokens a declared header value may carry:

• {{secret:NAME}} — the value entered at startup for NAME under --prompt-missing if there is one, else the process env var NAME.
• {{secret-file:PATH}} — the contents of the mounted file at PATH, re-read at the moment of use, so rotating the mounted file takes effect without restarting the daemon.

Both resolve locally — a filesystem path or an env var, never a URL and never a network fetch — so resolving a secret can never itself become an egress channel. The template is structural and may live in the config file or on a flag; the resolved value is materialized only at the instant of use, is never retained, and never reaches a log or error line. That split is what makes “the config file is secret-free” a fact rather than a convention: what the file holds is a reference, not a value.

Functions

has_secret_ref

Does value contain at least one {{secret:…}} / {{secret-file:…}} ref? The validator uses this to tell a legal secret reference apart from an illegal inline literal under a secret-shaped key: a header named Authorization holding a reference is fine, the same header holding the token itself is a config error.

prompted_of

read_token_file

Read a credential from a mounted file, trimming a single trailing newline (kubelet projects a Secret value verbatim; an editor or echo commonly appends a \n). Errors carry the path but never the contents, so a failed read cannot spill the credential into a log or an error line.

refs_resolvable

Side-effect-free-as-possible pre-flight for --validate-config / startup: every ref in template must resolve (the env var is set; the file exists and is readable). Returns the same diagnostics resolve would, without retaining the resolved bytes. A {{secret-file:…}} IS read here — an unreadable secret file must fail the config check rather than surface as a mystery 401 on the first outbound request — but the contents are dropped immediately.

resolve

Resolve every {{secret:NAME}} / {{secret-file:PATH}} token in template against env (the process environment) and the local filesystem, returning the materialized string. Plain text passes through unchanged. A bad token (missing env var, unreadable file, or an unterminated {{) is an Err with a message that names the ref but never the resolved value.

secret_available

Whether {{secret:NAME}} would resolve right now (prompted or environment).

set_prompted

Record an interactively-entered value for {{secret:NAME}} resolution.