Enum InternalAuthConfig 

pub enum InternalAuthConfig {
    SharedSecret {
        secret: SecretString,
        peer_name: String,
    },
    Kube {
        audiences: Vec<String>,
        token_path: Option<PathBuf>,
    },
}

Platform-plane authentication provider selection.

Serialized with an internal provider tag, e.g.

internal_auth:
  provider: shared_secret
  secret: "dev-internal-token"
  peer_name: "hello"

or

internal_auth:
  provider: kube
  audiences: ["toolkit-internal"]
  token_path: /var/run/secrets/tokens/toolkit-internal

Variants

SharedSecret

A single pre-shared secret (dev / single-node). See the module docs.

Fields

secret: SecretString

The shared token accepted (inbound) and attached (outbound).

A SecretString rather than a String so redaction is structural: it zeroizes on drop and renders as [REDACTED] in any {:?} sink, instead of depending on the hand-written Debug and Serialize impls below staying correct as fields are added.

peer_name: String

Caller label assigned to validated peers (inbound side only).

Kube

A projected Kubernetes ServiceAccount token (Profile 3).

Fields

audiences: Vec<String>

Expected token audiences for TokenReview (inbound).

Required, and must not be empty. An empty list disables audience binding twice over in toolkit-k8s-auth: no audience is sent to the API server, and the client-side comparison against the response is skipped. Any ServiceAccount token the API server accepts — from any workload in the cluster, issued for any audience — would then authenticate as a platform peer.

It used to default to empty, so a config that simply omitted the field got that silently.

token_path: Option<PathBuf>

Projected-token path to read + rotate for outbound calls. When absent, no outbound credential is attached (inbound-only).

Implementations

impl InternalAuthConfig

pub fn build_authenticator( &self, ) -> Result<BuiltAuthenticator, InvalidInternalAuth>

Build the inbound validator when it can be constructed without a heavier backend.

Errors

Returns InvalidInternalAuth::SharedSecret when the configured shared secret is unusable — empty, or the redaction placeholder from a serialized config. Returns InvalidInternalAuth::EmptyKubeAudiences when provider: kube has no configured audiences.

pub fn shared_secret(&self) -> Option<SecretString>

The static outbound credential for the shared-secret provider, if any.

pub fn is_kube(&self) -> bool

Whether this config selects the Kubernetes provider.

pub fn kube_audiences(&self) -> Option<&[String]>

The configured TokenReview audiences for the Kubernetes provider.

pub fn kube_token_path(&self) -> Option<&Path>

The projected-token path for the Kubernetes provider’s outbound credential, if configured.

Trait Implementations

impl Clone for InternalAuthConfig

fn clone(&self) -> InternalAuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for InternalAuthConfig

Manual Debug that never renders the shared secret. The derived impl would print secret verbatim, leaking the platform-plane credential into any {:?} sink (config tracing, panic messages, error context). All other fields — including peer_name and the Kube variant — are shown as-is.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for InternalAuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for InternalAuthConfig

Manual Serialize that never emits the shared secret in plaintext.

A derived Serialize would write secret verbatim, leaking the platform-plane credential whenever a containing config is serialized — most notably AppConfig::to_yaml behind --print-config. Instead the secret is replaced with a <redacted> placeholder; every other field (and the internally-tagged provider shape) is preserved so the output still round- trips structurally.

This is safe because the config is only ever deserialized to obtain the real secret; serialization is used for diagnostics, never to transmit the credential.

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.