Conversation
…yment guide
- Replace _file twin fields with Secret newtype (plain string or
{ file = "path" } TOML forms, Debug redacted)
- Warn on invalid numeric/enum env values instead of silently ignoring
- Warn on unrecognized K2I_* variables (typo detection)
- Serialize env-var tests through a mutex to remove race
- Add docs/kubernetes.md covering projected volumes, env injection,
and Secrets Store CSI Driver
Contributor
Author
|
Superseded by #8 — combined into a single PR with the cloud object-store work. Same tree, conflict-resolved and verified (289 tests green). |
sionsmith
pushed a commit
that referenced
this pull request
Jul 28, 2026
GCS/Azure object stores + credential chain docs (PR #8): - GCS backend with ADC / Workload Identity Federation - Azure backend (az:// and abfs://) with DefaultAzureCredential chain - S3 default credential chain docs (env -> IMDS -> IRSA) Config secret injection (PR #9): - Secret newtype for credential fields: plain string or { file = "path" } TOML forms, Debug redacted, expose() accessors - K2I_* env var overrides with warnings on invalid numeric/enum values and unrecognized variables (typo detection) - Mutex-serialized env-var tests - docs/kubernetes.md: projected volumes, env injection, Secrets Store CSI Driver, full variable table - azure_access_key uses Secret for consistency Closes #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1
Two complementary patterns for injecting configuration outside TOML files, designed for Kubernetes deployments with Secrets Store CSI Driver or projected volumes. No secret ever needs to live in a ConfigMap.
1.
Secrettype with file refsSensitive fields use a
Secretnewtype that deserializes from either a plain string or a{ file = "path" }inline table (Kubernetes projected volumes). File contents are trimmed; a missing file fails startup with a clear error.Debugis redacted (Secret(REDACTED)).Fields:
kafka.security.sasl_username/sasl_password,iceberg.aws_access_key_id/aws_secret_access_key,iceberg.rest.credential/oauth2_client_id/oauth2_client_secret.2. Env var overrides
K2I_+ uppercase path with_separators. Invalid numeric/enum values warn (TOML preserved), unrecognizedK2I_*variables warn for typo detection.Docs
docs/kubernetes.md— projectedSecretvolumes, env/secretKeyRef, Secrets Store CSI Driver, 38-variable tableconfig/example.toml— both patterns documented inlineVerification
cargo check --workspace --tests— clean, zero warningscargo test --workspace— 285 passed, 0 failedK2I_KAFKA_TOPC, validate passes