Struct SecretBinding 

pub struct SecretBinding {
    pub env_var: String,
    pub target_host: String,
    pub header: String,
    pub value: Option<String>,
}

A secret binding maps an environment variable to a target domain, optionally specifying which HTTP header carries the credential.

When injected into a microVM, the secret value is written to the secrets drive (readable only by the guest agent). A placeholder value is set in the guest environment so tools that check for the variable’s existence pass their preflight checks.

Combined with NetworkPolicy allowlists, secrets can only be sent to their bound domains.

Fields

env_var: String

Environment variable name (e.g., OPENAI_API_KEY).

target_host: String

Domain this secret is scoped to (e.g., api.openai.com).

header: String

HTTP header name for the credential. Defaults to Authorization.

value: Option<String>

The secret value. If None, read from the host environment.

Implementations

impl SecretBinding

pub fn new(env_var: impl Into<String>, target_host: impl Into<String>) -> Self

pub fn with_header(self, header: impl Into<String>) -> Self

pub fn with_value(self, value: impl Into<String>) -> Self

pub fn resolve_value(&self) -> Result<String>

Resolve the secret value: use the explicit value if set, otherwise read from the host environment.

pub fn placeholder(&self) -> String

Generate the placeholder value for the guest environment.

pub fn secret_filename(&self) -> String

Generate a secret file entry for the secrets drive. The file is named after the env var (lowercase, dots replaced).

Trait Implementations

impl Clone for SecretBinding

fn clone(&self) -> SecretBinding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretBinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretBinding

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for SecretBinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromStr for SecretBinding

Parse a secret binding from CLI syntax:

• KEY:host — read KEY from env, inject as Authorization header to host
• KEY:host:header — custom header name
• KEY=value:host — explicit value
• KEY=value:host:header — explicit value + custom header

type Err = Error

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq for SecretBinding

fn eq(&self, other: &SecretBinding) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecretBinding

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for SecretBinding

impl StructuralPartialEq for SecretBinding