Module secret 

File-based secret refs (RFC 0017 §6, riding RFC 0006 §6 / RFC 0012 §3.7).

Secrets are env/file only — never in the config file, never logged (RFC 0012 §3.7). This module is the file-backed half of the secret front door: it reads a credential from a mounted file (a Kubernetes Secret volume), trims the trailing newline kubelet leaves on a projected file, and resolves the two interpolation tokens a declared header value may carry:

• {{secret:NAME}} — the value of process env var NAME.
• {{secret-file:PATH}} — the contents of the mounted file at PATH, re-read at the moment of use so a rotation takes effect without a restart (RFC 0017 §6.1/§6.2).

Both are read_local only (RFC 0011 §3.1): a filesystem path, no URL scheme, no network. The template ({{secret:…}} / {{secret-file:…}}) is structural and may live in the config file or a flag; the resolved value is materialized only at the instant of use and is never retained, never logged. A reference is structural; the value is not in the file — so the RFC 0011/0012 “the file is secret-free” invariant holds exactly.

Functions

has_secret_ref

Does value contain at least one {{secret:…}} / {{secret-file:…}} ref? Used by the validator to distinguish a (legal) secret reference from an (illegal) inline secret-shaped scalar in a declared header (RFC 0017 §3.1).

read_token_file

Read a credential from a mounted file, trimming a single trailing newline (kubelet projects a Secret value verbatim; an editor/echo commonly appends a \n). Errors carry the path but NOT the contents (RFC 0012 §3.7 — a secret never reaches a log/error line).

refs_resolvable

Side-effect-free-as-possible pre-flight for --validate-config / startup: every ref in template must resolve (the env var is set; the file exists and is readable). Returns the same diagnostics resolve would, without retaining the resolved bytes. A {{secret-file:…}} IS read here (it must exist to be valid, RFC 0017 §6.2 — “missing/unreadable at startup → exit 2”), but the contents are dropped immediately.

resolve

Resolve every {{secret:NAME}} / {{secret-file:PATH}} token in template against env (the process environment) and the local filesystem, returning the materialized string. Plain text passes through unchanged. A bad token (missing env var, unreadable file, or an unterminated {{) is an Err with a message that names the ref but NOT the resolved value (RFC 0012 §3.7).