SmallRye Config SecretKeys support

core/deployment/src/main/java/io/quarkus/deployment/configuration/BuildTimeConfigurationReader.java

@@ -27,6 +27,7 @@
 import java.util.SortedSet;
 import java.util.TreeMap;
 
+import io.smallrye.config.SecretKeys;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.eclipse.microprofile.config.spi.Converter;
@@ -319,7 +320,7 @@ public List<ConfigClassWithPrefix> getBuildTimeVisibleMappings() {
     }
 
     public ReadResult readConfiguration(final SmallRyeConfig config) {
-        return new ReadOperation(config).run();
+        return SecretKeys.doUnlocked(() -> new ReadOperation(config).run());
     }
 
     final class ReadOperation {

integration-tests/test-extension/extension/deployment/src/test/java/io/quarkus/config/SecretKeysConfigInterceptorFactory.java

@@ -0,0 +1,15 @@
+package io.quarkus.config;
+
+import java.util.Set;
+
+import io.smallrye.config.ConfigSourceInterceptor;
+import io.smallrye.config.ConfigSourceInterceptorContext;
+import io.smallrye.config.ConfigSourceInterceptorFactory;
+import io.smallrye.config.SecretKeysConfigSourceInterceptor;
+
+public class SecretKeysConfigInterceptorFactory implements ConfigSourceInterceptorFactory {
+    @Override
+    public ConfigSourceInterceptor getInterceptor(final ConfigSourceInterceptorContext configSourceInterceptorContext) {
+        return new SecretKeysConfigSourceInterceptor(Set.of("secrets.my.secret"));
+    }
+}

integration-tests/test-extension/extension/deployment/src/test/java/io/quarkus/config/SecretKeysConfigTest.java

@@ -0,0 +1,45 @@
+package io.quarkus.config;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import javax.inject.Inject;
+
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import io.quarkus.test.QuarkusUnitTest;
+import io.smallrye.config.ConfigMapping;
+import io.smallrye.config.SmallRyeConfig;
+
+public class SecretKeysConfigTest {
+    @RegisterExtension
+    static final QuarkusUnitTest TEST = new QuarkusUnitTest()
+            .withApplicationRoot((jar) -> jar
+                    .addClass(SecretKeysConfigInterceptorFactory.class)
+                    .addAsServiceProvider("io.smallrye.config.ConfigSourceInterceptorFactory",
+                            SecretKeysConfigInterceptorFactory.class.getName()))
+            .overrideConfigKey("secrets.my.secret", "secret");
+
+    @Inject
+    SmallRyeConfig config;
+    @Inject
+    @ConfigProperty(name = "secrets.my.secret")
+    String secret;
+    @Inject
+    MappingSecret mappingSecret;
+
+    @Test
+    void secrets() {
+        assertThrows(SecurityException.class, () -> config.getConfigValue("secrets.my.secret"));
+
+        assertEquals("secret", secret);
+        assertEquals("secret", mappingSecret.secret());
+    }
+
+    @ConfigMapping(prefix = "secrets.my")
+    interface MappingSecret {
+        String secret();
+    }
+}