Configuration describes how the process should run. A secret reference names where a sensitive value is obtained; it is not the value itself. Workload identity explains who may retrieve that value at runtime.
The lab accepts a port, an internal database host, a secret reference and a role reference. It rejects unexpected keys rather than silently accepting a pasted password. secret://lab and role://lab are fictional identifiers used by local fixtures, not production credentials or provider ARNs.
Use canonical strings to avoid ambiguous port representations such as08080. Reject0 and values above65535. The lab internal hostname convention makes the intended private destination visible, but a name ending.internal is not evidence of actual private DNS or network reachability.
A reference cannot grant access by itself. The role must have permission for the secret, and the real platform must deliver credentials through its supported workload identity mechanism. Do not place long-lived human access keys in an image, source file, browser or downloaded fixture.
from dataclasses import dataclass
import ipaddress
import re
class PlanError(ValueError):
pass
def bounded_text(value, label):
if not isinstance(value,str) or not value.strip() or len(value)>200:
raise PlanError(label)
return value
def integer(value, low, high):
if type(value) is not int or not low<=value<=high:
raise PlanError("integer outside plan bounds")
return value
@dataclass(frozen=True)
class RuntimeConfig:
port: int
database_host: str
secret_reference: str
workload_role: str
def runtime_config(values):
"""Validate references/configuration; never fetch a secret or grant a role."""
if not isinstance(values,dict):raise PlanError("configuration object required")
expected={"PORT","DATABASE_HOST","DATABASE_SECRET_REF","WORKLOAD_ROLE"}
if set(values)!=expected:raise PlanError("missing or unexpected configuration key")
raw=values["PORT"]
if not isinstance(raw,str) or not re.fullmatch(r"[1-9][0-9]{0,4}",raw):raise PlanError("canonical port")
port=integer(int(raw),1,65535)
host=values["DATABASE_HOST"]
if not isinstance(host,str) or not re.fullmatch(r"[a-z][a-z0-9.-]{0,100}\.internal",host):raise PlanError("lab internal host")
secret=values["DATABASE_SECRET_REF"]
if not isinstance(secret,str) or not re.fullmatch(r"secret://lab/[a-z][a-z0-9-]{0,40}",secret):raise PlanError("secret reference only")
role=values["WORKLOAD_ROLE"]
if not isinstance(role,str) or not re.fullmatch(r"role://lab/[a-z][a-z0-9-]{0,40}",role):raise PlanError("workload role reference")
return RuntimeConfig(port,host,secret,role)
c=runtime_config({"PORT":"8080","DATABASE_HOST":"notes-db.internal","DATABASE_SECRET_REF":"secret://lab/notes-db","WORKLOAD_ROLE":"role://lab/notes-api"})
print(c.port,c.database_host)
print("reference only",c.secret_reference.startswith("secret://lab/"))Keep configuration, identity and secret retrieval separately testable. The function validates shape and returns a frozen RuntimeConfig; it never calls a provider or logs a secret value. The final plan then checks whether the declared role has the narrowly required read permission.
The exact-key rule is deliberately strict for this fixture. A production configuration loader may accept a richer schema, but should still make unknown keys and sensitive-value handling explicit. Do not mistake a valid reference string for proof that rotation, retrieval or connectivity works.
allowed={"PORT","DATABASE_HOST","DATABASE_SECRET_REF","WORKLOAD_ROLE"}
provided=allowed|{"PASSWORD"}
print("unexpected",sorted(provided-allowed))
print("a reference does not grant permission")Implement strict configuration validation. Explain which checks validate strings and which real platform mechanisms would still be needed. Next add recovery, cost and teardown decisions.