pub fn shared_secret_configured() -> boolExpand description
Returns true when shared-secret authentication is the selected mode — i.e.
BIND_API_TOKEN_ENV is set to a non-empty value.
Shared-secret and Kubernetes TokenReview are mutually exclusive: a single Bearer token cannot be both the shared secret and a valid ServiceAccount token. When a shared secret is configured it is the selected mode, so the TokenReview path is not consulted at request time and the fail-closed TokenReview authorization posture (A2) is not enforced at startup. TokenReview is used only when no shared secret is set (and the feature is compiled in).