[nlchung]

What does this PR do?

Trims leading/trailing spaces and tabs before matching ENC[...] secret references in pkg/secrets, matching the Agent's comp/core/secrets/utils.IsEnc.

• parseEnc trims once and returns the handle; IsEnc and extractHandle use it.
• fetchSecret keys results by the original input instead of rebuilding ENC[<handle>], so callers can look up padded references without changes. For unpadded inputs the keys are identical to before. encFormat is removed as unused.

Motivation

CONTP-2323. Per the brief, credentials and DDGR secret references (CONTP-2284) should share the Agent's matching behavior.

Additional Notes

• A padded value like " ENC[handle]\t" is now resolved through the secret backend instead of being used as a literal key. With no backend configured, it now fails at credential loading with a secret-backend error.
• Exact references, literal values and decrypted values are unchanged. Only spaces and tabs are trimmed, as in the Agent.

Minimum Agent Versions

N/A

Describe your test plan

• Unit tests in pkg/secrets and pkg/config cover padded references and trimming boundaries (newlines, padded literals).
• Local deployment on minikube with --secretBackendCommand=/readsecret.sh reading a mounted Secret, and API endpoints pointed at an in-cluster echo server to capture the Dd-Api-Key header:
  • Padded ENC[...] references in DD_API_KEY/DD_APP_KEY (e.g. " ENC[api_key]\t") resolve, and metadata requests use the decrypted key.
  • A padded ENC[...] reference in a DatadogAgent's spec.global.credentials.apiKey resolves for the metrics forwarder (validate, events, series).
  • Unpadded ENC[...] references in both places still resolve.
  • Control: the previous image sends padded references as the raw ENC[...] string.

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 57.89% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 155c8aa | Docs | View more details | Give us feedback!}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T15:10:56.892141Z	155c8aa	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gabedos]

nit: could it be worth leaving an explicit comment in the code about how this is meant to mirror the way the Agent parses ENC (and maybe which package in the agent code it's reflecting?)

[gabedos]

lgtm