The current setup of a local config file in the tool's $HOME that includes both the secrets and non-secret config works well for running, but makes sharing the config with the community difficult. It would be nicer to change things so that config is assembled from a combination of public and private configs.

There are many ways this could be done. One that might actually solve some other issues would be to use an init container and a non-persistent volume to merge config at pod startup into a volume and then mount that volume from the main container. The additional issue that could be solved with this is also putting the remotenickformat.tengo script into the volume so that its reads are not hits against NFS.

A lower tech method would just be doing whatever the merge operation is in the tool's $HOME before starting the pod.