pub(crate) fn require_token_tls(
token_present: bool,
tls_present: bool,
) -> Result<()>Expand description
Read a bearer token from a mounted-Secret file, trimming the trailing whitespace/newline that Secret files commonly carry. A missing or unreadable path is fatal — a silently-empty token would defeat auth.
Not feature-gated (its tests run in every build), but only called from the
k8s arm — so a bin-only build without k8s sees it as dead. Allow that.
Refuse to start the k8s backend with a session-plane token but no TLS: the
token would be written in the clear on every per-agent dial (see the preamble
in caliband::transport), defeating its purpose. Fail fast at startup rather
than silently transmit it (#107).
Like read_token_file, only called from the k8s arm, so a non-k8s build
sees it as dead — but its test runs in every build.