feat: Token encryption

go.mod

@@ -25,6 +25,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/coder/websocket v1.8.12
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
+	github.com/dgraph-io/ristretto/v2 v2.0.0
 	github.com/fatih/color v1.18.0
 	github.com/go-playground/locales v0.14.1
 	github.com/go-playground/universal-translator v0.18.1
@@ -41,6 +42,7 @@ require (
 	github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629
 	github.com/json-iterator/go v1.1.12
 	github.com/keboola/go-client v1.28.0
+	github.com/keboola/go-cloud-encrypt v0.0.0-20250106091332-dc146aee35a0
 	github.com/keboola/go-utils v1.2.0
 	github.com/klauspost/compress v1.17.11
 	github.com/klauspost/pgzip v1.2.6
@@ -152,15 +154,19 @@ require (
 	cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
 	cloud.google.com/go/compute/metadata v0.5.2 // indirect
 	cloud.google.com/go/iam v1.2.1 // indirect
+	cloud.google.com/go/kms v1.20.0 // indirect
+	cloud.google.com/go/longrunning v0.6.1 // indirect
 	cloud.google.com/go/monitoring v1.21.1 // indirect
 	cloud.google.com/go/storage v1.46.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1 // indirect
 	github.com/DataDog/appsec-internal-go v1.9.0 // indirect
 	github.com/DataDog/datadog-agent/pkg/proto v0.58.0 // indirect
 	github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.58.0 // indirect
@@ -198,6 +204,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.37.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.66.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.24.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 // indirect

go.sum

@@ -15,6 +15,8 @@ cloud.google.com/go/compute/metadata v0.5.2 h1:UxK4uu/Tn+I3p2dYWTfiX4wva7aYlKixA
 cloud.google.com/go/compute/metadata v0.5.2/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k=
 cloud.google.com/go/iam v1.2.1 h1:QFct02HRb7H12J/3utj0qf5tobFh9V4vR6h9eX5EBRU=
 cloud.google.com/go/iam v1.2.1/go.mod h1:3VUIJDPpwT6p/amXRC5GY8fCCh70lxPygguVtI0Z4/g=
+cloud.google.com/go/kms v1.20.0 h1:uKUvjGqbBlI96xGE669hcVnEMw1Px/Mvfa62dhM5UrY=
+cloud.google.com/go/kms v1.20.0/go.mod h1:/dMbFF1tLLFnQV44AoI2GlotbjowyUfgVwezxW291fM=
 cloud.google.com/go/logging v1.11.0 h1:v3ktVzXMV7CwHq1MBF65wcqLMA7i+z3YxbUsoK7mOKs=
 cloud.google.com/go/logging v1.11.0/go.mod h1:5LDiJC/RxTt+fHc1LAt20R9TKiUTReDg6RuuFOZ67+A=
 cloud.google.com/go/longrunning v0.6.1 h1:lOLTFxYpr8hcRtcwWir5ITh1PAKUD/sG2lKrTSYjyMc=
@@ -33,20 +35,28 @@ github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkk
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 h1:JZg6HRh6W6U4OLl6lk7BZ7BLisIzM9dG1R50zUk9C/M=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0/go.mod h1:YL1xnZ6QejvQHWJrX/AvhFl4WW4rqHVoKspWNVwFk0M=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 h1:tfLQ34V6F7tVSwoTf/4lH5sE0o6eCJuNDTmH09nDpbc=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 h1:B/dfvscEQtew9dVuoxqxrUKKv8Ih2f55PydknDamU+g=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0/go.mod h1:fiPSssYvltE08HJchL04dOy+RD4hgrjph0cwGGMntdI=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.0 h1:+m0M/LFxN43KvULkDNfdXOgrjtg6UYJPFBJyuEcRCAw=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.0/go.mod h1:PwOyop78lveYMRs6oCxjiVyBdyCgIYH6XHIVZO9/SFQ=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0 h1:PiSrjRPpkQNjrM8H0WwKMnZUdu1RGMtd/LdGKUrOo+c=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0/go.mod h1:oDrbWx4ewMylP7xHivfgixbfGBT6APAwsSoHRKotnIc=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0 h1:7rKG7UmnrxX4N53TFhkYqjc+kVUZuw0fL8I3Fh+Ld9E=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0/go.mod h1:Wjo+24QJVhhl/L7jy6w9yzFF2yDOf3cKECAa8ecf9vE=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 h1:eXnN9kaS8TiDwXjoie3hMRLuwdUBUMW9KRgOqB3mCaw=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0/go.mod h1:XIpam8wumeZ5rVMuhdDQLMfIPDf1WO3IzrCRO3e3e3o=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1 h1:cf+OIKbkmMHBaC3u78AXomweqM0oxQSgBXRZf3WH4yM=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1/go.mod h1:ap1dmS6vQKJxSMNiGJcq4QuUQkOynyD93gLw6MDF7ek=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
 github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1 h1:gUDtaZk8heteyfdmv+pcfHvhR9llnh7c7GMwZ8RVG04=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb h1:ZVN4Iat3runWOFLaBCDVU5a9X/XikSRBosye++6gojw=
 github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -163,6 +173,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 h1:tHxQi/XHP
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4/go.mod h1:4GQbF1vJzG60poZqWatZlhP31y8PGCCVTvIGPdaaYJ0=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.4 h1:E5ZAVOmI2apR8ADb72Q63KqwwwdW1XcMeXIlrZ1Psjg=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.4/go.mod h1:wezzqVUOVVdk+2Z/JzQT4NxAU0NbhRe5W8pIE72jsWI=
+github.com/aws/aws-sdk-go-v2/service/kms v1.37.2 h1:tfBABi5R6aSZlhgTWHxL+opYUDOnIGoNcJLwVYv0jLM=
+github.com/aws/aws-sdk-go-v2/service/kms v1.37.2/go.mod h1:dZYFcQwuoh+cLOlFnZItijZptmyDhRIkOKWFO1CfzV8=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.66.3 h1:neNOYJl72bHrz9ikAEED4VqWyND/Po0DnEx64RW6YM4=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.66.3/go.mod h1:TMhLIyRIyoGVlaEMAt+ITMbwskSTpcGsCPDq91/ihY0=
 github.com/aws/aws-sdk-go-v2/service/sso v1.24.5 h1:HJwZwRt2Z2Tdec+m+fPjvdmkq2s9Ra+VR0hjF7V2o40=
@@ -231,6 +243,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgraph-io/ristretto/v2 v2.0.0 h1:l0yiSOtlJvc0otkqyMaDNysg8E9/F/TYZwMbxscNOAQ=
+github.com/dgraph-io/ristretto/v2 v2.0.0/go.mod h1:FVFokF2dRqXyPyeMnK1YDy8Fc6aTe0IKgbcd03CYeEk=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
@@ -472,6 +486,8 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/keboola/go-client v1.28.0 h1:oXgyw9gSACMkEBmVjhx26rmeFP2nn/h+EpV5LEeD7ds=
 github.com/keboola/go-client v1.28.0/go.mod h1:UKsl17jZA1xSa0jQrxw1MAo7GNj+OA5Y/MXjOp/6FkM=
+github.com/keboola/go-cloud-encrypt v0.0.0-20250106091332-dc146aee35a0 h1:RFoMGkPgqg55/069QJn0q8dUarM1myODO3jcVUGiifw=
+github.com/keboola/go-cloud-encrypt v0.0.0-20250106091332-dc146aee35a0/go.mod h1:ynHaykn5QuPKbUB2uJYNN+feY/Hg5BCp/TDb+yOSoTo=
 github.com/keboola/go-jsonnet v0.20.1-0.20240430105602-71646d8d4fa9 h1:BY9wMWSN1SEIjhBJSrFWpLLS3DiAR+GNANOSTNtfzGA=
 github.com/keboola/go-jsonnet v0.20.1-0.20240430105602-71646d8d4fa9/go.mod h1:pSOb2+VoKZjVbIB4z58am8q15yWO/VTEp6n1GxW3x0I=
 github.com/keboola/go-mockoidc v0.0.0-20240405064136-5229d2b53db6 h1:HcvX1VQkiavyfqDzXeCsNYlhiPaLiGhU7jlIKUj8JOE=
@@ -480,6 +496,8 @@ github.com/keboola/go-oauth2-proxy/v7 v7.6.1-0.20240418143152-9d00aaa29562 h1:Ei
 github.com/keboola/go-oauth2-proxy/v7 v7.6.1-0.20240418143152-9d00aaa29562/go.mod h1:uPrZkzwsuFyIPP04hIt6TG2KvWujglvkOnUUnQJyIdw=
 github.com/keboola/go-utils v1.2.0 h1:mz12Eo+/XW+V0qcEGN4mkXQjrFOdxy+muWe0hLj2n/c=
 github.com/keboola/go-utils v1.2.0/go.mod h1:4YVC2/V0QwgHqxtch8JAVDNVI1aINF2arJ7sh6TO1GY=
+github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6 h1:IsMZxCuZqKuao2vNdfD82fjjgPLfyHLpR41Z88viRWs=
+github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6/go.mod h1:3VeWNIJaW+O5xpRQbPp0Ybqu1vJd/pm7s2F473HRrkw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=

internal/pkg/service/common/configmap/bind.go

@@ -242,6 +242,11 @@ func ValidateAndNormalize(target any) error {
 				value = value.Addr()
 			}
 
+			// Invalid value may happen if a Normalize call replaces a value with nil before it can be visited
+			if value.Kind() == reflect.Invalid {
+				return nil
+			}
+
 			// Call Normalize method, if any
 			if v, ok := value.Interface().(ValueWithNormalization); ok {
 				v.Normalize()

internal/pkg/service/common/configmap/bind_test.go

@@ -94,6 +94,7 @@ func TestGenerateAndBind_DefaultValues(t *testing.T) {
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             addrValue,
 		AddrNullable:     &addrValue,
+		ByteSlice:        []byte("value3"),
 	}
 	target := expected
 
@@ -121,6 +122,7 @@ func TestGenerateAndBind_Flags(t *testing.T) {
 			"--url", "https://foo.bar",
 			"--address", "10.20.30.40",
 			"--address-nullable", "10.20.30.40",
+			"--byte-slice", "Ynl0ZXM=",
 			"pos1", "pos2", "pos3",
 		},
 		EnvNaming:              env.NewNamingConvention("MY_APP_"),
@@ -150,6 +152,7 @@ func TestGenerateAndBind_Flags(t *testing.T) {
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             defaultAddrValue,
 		AddrNullable:     &defaultAddrValue,
+		ByteSlice:        []byte("value3"),
 	}
 
 	// Default values are replaced from flags
@@ -172,6 +175,7 @@ func TestGenerateAndBind_Flags(t *testing.T) {
 		URL:              &url.URL{Scheme: "https", Host: "foo.bar"},
 		Addr:             expectedAddrValue,
 		AddrNullable:     &expectedAddrValue,
+		ByteSlice:        []byte("bytes"),
 	}, target)
 }
 
@@ -191,6 +195,7 @@ func TestGenerateAndBind_Env(t *testing.T) {
 	envs.Set("MY_APP_DURATION_NULLABLE", "100s")
 	envs.Set("MY_APP_ADDRESS", "10.20.30.40")
 	envs.Set("MY_APP_ADDRESS_NULLABLE", "10.20.30.40")
+	envs.Set("MY_APP_BYTE_SLICE", "Ynl0ZXM=")
 
 	cfg := GenerateAndBindConfig{
 		Args: []string{
@@ -222,6 +227,7 @@ func TestGenerateAndBind_Env(t *testing.T) {
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             defaultAddrValue,
 		AddrNullable:     &defaultAddrValue,
+		ByteSlice:        []byte("value3"),
 	}
 
 	// Default values are replaced from ENVs
@@ -245,6 +251,7 @@ func TestGenerateAndBind_Env(t *testing.T) {
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             expectedAddrValue,
 		AddrNullable:     &expectedAddrValue,
+		ByteSlice:        []byte("bytes"),
 	}, target)
 }
 
@@ -295,6 +302,7 @@ func TestGenerateAndBind_ConfigFile_YAML(t *testing.T) {
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             defaultAddrValue,
 		AddrNullable:     &defaultAddrValue,
+		ByteSlice:        []byte("value3"),
 	}
 
 	// Write YAML config files
@@ -304,6 +312,7 @@ nested:
   bar: 1000
 address: 11.22.33.44
 addressNullable: 11.22.33.44
+byteSlice: "Ynl0ZXM="
 `
 	require.NoError(t, os.WriteFile(configFilePath1, []byte(config1), 0o600))
 	config2 := `
@@ -333,6 +342,7 @@ int: 999
 		URL:              &url.URL{Scheme: "https", Host: "foo.bar"},
 		Addr:             expectedAddrValue,
 		AddrNullable:     &expectedAddrValue,
+		ByteSlice:        []byte("bytes"),
 	}, target)
 }
 
@@ -384,6 +394,7 @@ func TestGenerateAndBind_ConfigFile_JSON(t *testing.T) {
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             defaultAddrValue,
 		AddrNullable:     &defaultAddrValue,
+		ByteSlice:        []byte("value3"),
 	}
 
 	// Write YAML config files
@@ -394,7 +405,8 @@ func TestGenerateAndBind_ConfigFile_JSON(t *testing.T) {
     "bar": 1000
   },
   "address": "11.22.33.44",
-  "addressNullable": "11.22.33.44"
+  "addressNullable": "11.22.33.44",
+  "byteSlice": "dmFsdWUz"
 }
 `
 	require.NoError(t, os.WriteFile(configFilePath1, []byte(config1), 0o600))
@@ -427,6 +439,7 @@ func TestGenerateAndBind_ConfigFile_JSON(t *testing.T) {
 		URL:              &url.URL{Scheme: "https", Host: "foo.bar"},
 		Addr:             expectedAddrValue,
 		AddrNullable:     &expectedAddrValue,
+		ByteSlice:        []byte("value3"),
 	}, target)
 }
 
@@ -449,6 +462,7 @@ func TestGenerateAndBind_ValueType(t *testing.T) {
 			"--embedded", "flag takes precedence over ENV",
 			"--address", "11.22.33.44",
 			"--address-nullable", "11.22.33.44",
+			"--byte-slice", "Ynl0ZXM=",
 			"--config-file", configFilePath,
 		},
 		EnvNaming:              env.NewNamingConvention("MY_APP_"),
@@ -482,6 +496,7 @@ stringSlice: a,b,c
 		URL:              Value[*url.URL]{Value: &url.URL{Scheme: "http", Host: "localhost:1234"}},
 		Addr:             Value[netip.Addr]{Value: defaultAddrValue},
 		AddrNullable:     Value[*netip.Addr]{Value: &defaultAddrValue},
+		ByteSlice:        Value[[]byte]{Value: []byte("value3")},
 	}
 
 	// Default values are replaced from the flags and ENVs
@@ -510,6 +525,7 @@ stringSlice: a,b,c
 		URL:              Value[*url.URL]{Value: &url.URL{Scheme: "http", Host: "localhost:1234"}, SetBy: SetByDefault},
 		Addr:             Value[netip.Addr]{Value: expectedAddrValue, SetBy: SetByFlag},
 		AddrNullable:     Value[*netip.Addr]{Value: &expectedAddrValue, SetBy: SetByFlag},
+		ByteSlice:        Value[[]byte]{Value: []byte("bytes"), SetBy: SetByFlag},
 	}, target)
 }
 
@@ -558,6 +574,7 @@ durationNullable: 1m40s
 url: null
 address: ""
 addressNullable: null
+byteSlice: ""
 nested:
     foo: ""
     bar: 0

internal/pkg/service/common/configmap/configmap_test.go

@@ -60,6 +60,7 @@ type TestConfig struct {
 	URL              *url.URL         `configKey:"url" configShorthand:"u"`
 	Addr             netip.Addr       `configKey:"address"`         // TextUnmarshaler/BinaryUnmarshaler interface
 	AddrNullable     *netip.Addr      `configKey:"addressNullable"` // TextUnmarshaler/BinaryUnmarshaler interface
+	ByteSlice        []byte           `configKey:"byteSlice"`
 	Nested           Nested           `configKey:"nested"`
 	Skipped          bool             `configKey:"-"`
 }
@@ -89,6 +90,7 @@ type TestConfigWithValueStruct struct {
 	URL              Value[*url.URL]         `configKey:"url" configShorthand:"u"`
 	Addr             Value[netip.Addr]       `configKey:"address"`         // TextUnmarshaler/BinaryUnmarshaler interface
 	AddrNullable     Value[*netip.Addr]      `configKey:"addressNullable"` // TextUnmarshaler/BinaryUnmarshaler interface
+	ByteSlice        Value[[]byte]           `configKey:"byteSlice"`
 	Nested           NestedValue             `configKey:"nested"`
 	Skipped          bool                    `configKey:"-"`
 }

internal/pkg/service/common/configmap/dump.go

@@ -48,7 +48,7 @@ func (d *Dumper) Dump(v any) *Dumper {
 	err := Visit(reflect.ValueOf(v), VisitConfig{
 		OnField: mapAndFilterField(),
 		OnValue: func(vc *VisitContext) error {
-			if !vc.Leaf {
+			if !vc.Leaf || vc.Value.Kind() == reflect.Invalid {
 				return nil
 			}
 			return d.values.SetNestedPath(vc.MappedPath, dumpValue(vc))

internal/pkg/service/common/configmap/dump_test.go

@@ -19,6 +19,7 @@ func TestDumpFlat_Empty(t *testing.T) {
 {
   "address": "",
   "addressNullable": null,
+  "byteSlice": "",
   "customInt": 0,
   "customString": "",
   "duration": "0s",
@@ -45,6 +46,7 @@ func TestDumpFlat(t *testing.T) {
 {
   "address": "1.2.3.4",
   "addressNullable": null,
+  "byteSlice": "dmFsdWUz",
   "customInt": 567,
   "customString": "custom",
   "duration": "2m3s",
@@ -95,6 +97,7 @@ func TestDumpAsJSON(t *testing.T) {
   "url": "http://localhost:1234",
   "address": "1.2.3.4",
   "addressNullable": null,
+  "byteSlice": "dmFsdWUz",
   "nested": {
     "foo": "foo",
     "bar": 789
@@ -127,6 +130,7 @@ durationNullable: 2m3s
 url: http://localhost:1234
 address: 1.2.3.4
 addressNullable: null
+byteSlice: dmFsdWUz
 nested:
     foo: foo
     bar: 789
@@ -154,6 +158,7 @@ durationNullable: null
 url: null
 address: ""
 addressNullable: null
+byteSlice: ""
 nested:
     foo: ""
     bar: 0
@@ -185,6 +190,7 @@ durationNullable: 2m3s
 url: http://localhost:1234
 address: 1.2.3.4
 addressNullable: null
+byteSlice: dmFsdWUz
 nested:
     foo: foo
     bar: 789
@@ -208,6 +214,7 @@ func dumpTestConfig() TestConfig {
 		DurationNullable: &duration,
 		URL:              &url.URL{Scheme: "http", Host: "localhost:1234"},
 		Addr:             addrValue,
+		ByteSlice:        []byte("value3"),
 		Nested: Nested{
 			Foo: "foo",
 			Bar: 789,
@@ -235,6 +242,7 @@ func dumpTestConfigWithValueStruct() TestConfigWithValueStruct {
 		DurationNullable: Value[*time.Duration]{Value: &duration},
 		URL:              Value[*url.URL]{Value: &url.URL{Scheme: "http", Host: "localhost:1234"}},
 		Addr:             Value[netip.Addr]{Value: addrValue},
+		ByteSlice:        Value[[]byte]{Value: []byte("value3")},
 		Nested: NestedValue{
 			Foo: Value[string]{Value: "foo"},
 			Bar: Value[int]{Value: 789},