feat(valkey-store): add username_env/password_env credential indirection Add support for resolving Valkey credentials from environment variables named in the model config, mirroring cloud-proxy's api_key_env pattern. This keeps secrets out of model YAML files and lets distinct store configs each reference their own credentials. Options: username_env / password_env name the env var holding the value. The direct username / password options still work and take precedence when both are set (backward compatible). Includes 5 unit tests and updated stores.md documentation.

Signed-off-by: Daria Korenieva <daric2612@gmail.com>

Author: daric93

backend/go/valkey-store/config.go

@@ -23,6 +23,7 @@ package main
 
 import (
 	"fmt"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -76,6 +77,8 @@ const (
 	optAddr               = "addr"
 	optUsername           = "username"
 	optPassword           = "password"
+	optUsernameEnv        = "username_env"
+	optPasswordEnv        = "password_env"
 	optTLS                = "tls"
 	optTLSSkipVerify      = "tls_skip_verify"
 	optTLSCACert          = "tls_ca_cert"
@@ -164,8 +167,8 @@ func loadConfig(opts *pb.ModelOptions) (Config, error) {
 
 	cfg := Config{
 		Addr:           strOr(o, optAddr, _defaultAddr),
-		Username:       o[optUsername],
-		Password:       o[optPassword],
+		Username:       resolveCredential(o, optUsername, optUsernameEnv),
+		Password:       resolveCredential(o, optPassword, optPasswordEnv),
 		UseTLS:         boolOr(o, optTLS, false),
 		TLSSkipVerify:  boolOr(o, optTLSSkipVerify, false),
 		TLSCACert:      o[optTLSCACert],
@@ -236,3 +239,23 @@ func boolOr(o map[string]string, key string, fallback bool) bool {
 	}
 	return b
 }
+
+// resolveCredential resolves a credential value with the following priority:
+//  1. Direct value from the model config option (e.g. `username:admin`)
+//  2. Env-indirection: if `username_env` names an env var, read the credential
+//     from that variable (e.g. `username_env:MY_VALKEY_USER` → os.Getenv("MY_VALKEY_USER"))
+//
+// The env-indirection pattern (same as cloud-proxy's api_key_env) avoids putting
+// secrets directly in model YAML: distinct store configs can each reference a
+// different credential env var without any plaintext passwords in the config.
+func resolveCredential(o map[string]string, directKey, envKey string) string {
+	// Direct value takes precedence (backward compatible).
+	if v := o[directKey]; v != "" {
+		return v
+	}
+	// Env indirection: the option names an env var that holds the credential.
+	if envVar := o[envKey]; envVar != "" {
+		return os.Getenv(envVar)
+	}
+	return ""
+}

backend/go/valkey-store/store_test.go

@@ -111,6 +111,40 @@ var _ = Describe("loadConfig", func() {
 		_, err := loadConfig(opts("db:-1"))
 		Expect(err).To(HaveOccurred())
 	})
+
+	It("resolves username from direct option", func() {
+		cfg, err := loadConfig(opts("username:admin"))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(cfg.Username).To(Equal("admin"))
+	})
+
+	It("resolves password from env indirection via password_env", func() {
+		GinkgoT().Setenv("TEST_VALKEY_PW_INDIRECT", "s3cret")
+		cfg, err := loadConfig(opts("password_env:TEST_VALKEY_PW_INDIRECT"))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(cfg.Password).To(Equal("s3cret"))
+	})
+
+	It("resolves username from env indirection via username_env", func() {
+		GinkgoT().Setenv("TEST_VALKEY_USER_INDIRECT", "myuser")
+		cfg, err := loadConfig(opts("username_env:TEST_VALKEY_USER_INDIRECT"))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(cfg.Username).To(Equal("myuser"))
+	})
+
+	It("prefers the direct option over env indirection", func() {
+		GinkgoT().Setenv("TEST_VALKEY_PW_CLASH", "from-env")
+		cfg, err := loadConfig(opts("password:direct-value", "password_env:TEST_VALKEY_PW_CLASH"))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(cfg.Password).To(Equal("direct-value"))
+	})
+
+	It("returns empty when neither direct nor env indirection is set", func() {
+		cfg, err := loadConfig(opts("addr:localhost:6379"))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(cfg.Username).To(BeEmpty())
+		Expect(cfg.Password).To(BeEmpty())
+	})
 })
 
 var _ = Describe("Load namespace gate", func() {

docs/content/features/stores.md

@@ -84,18 +84,28 @@ name: my-vectors
 backend: valkey-store
 options:
   - addr:valkey.internal:6379
+  - username_env:MY_VALKEY_USER
+  - password_env:MY_VALKEY_PASSWORD
   - index_algo:HNSW
   - distance_metric:COSINE
 ```
 
+The `username_env` / `password_env` options name an environment variable that holds the actual
+credential rather than putting the secret directly in the YAML. This mirrors `cloud-proxy`'s
+`api_key_env` pattern and lets distinct store configs each reference their own credentials.
+The direct `username` / `password` options still work for backward compatibility, and take
+precedence when both are set.
+
 When no config exists for a store, the backend connects to `localhost:6379` with the defaults
 below (so the zero-config experience still works).
 
 | Option | Default | Description |
 |--------|---------|-------------|
 | `addr` | `localhost:6379` | Valkey server address (`host:port`). |
-| `username` | *(empty)* | Optional ACL username. |
-| `password` | *(empty)* | Optional password / ACL secret. |
+| `username` | *(empty)* | Optional ACL username (plaintext in config). |
+| `password` | *(empty)* | Optional password / ACL secret (plaintext in config). |
+| `username_env` | *(empty)* | Name of an env var that holds the username. Preferred over `username` for secrets — keeps credentials out of the model YAML. |
+| `password_env` | *(empty)* | Name of an env var that holds the password. Preferred over `password` for secrets. |
 | `tls` | `false` | Enable TLS (required by many managed deployments). |
 | `tls_ca_cert` | *(empty)* | Path to a PEM CA bundle used to verify the server certificate (self-signed / private CA). |
 | `tls_skip_verify` | `false` | Skip TLS certificate verification. Insecure — for testing only. |