Skip to content

Secrets

App secrets live in OpenBao, not in Git. You manage them in the DevOps portal.

  • Secrets are grouped into vaults per team: apps/<team>/<vault>/<item>.
  • Each vault lists which Kubernetes namespaces may read it. Pods get the values as normal Kubernetes Secrets through External Secrets.
  • In your app config, reference them by vault, item and key:
secrets: [{env: API_KEY, vault: <vault>, item: <item>, key: <key>}]

In the portal's app form, Secrets offers the vaults connected to the app's namespace and suggests item and key names. Key names are read from OpenBao with your own access (names only, never values); where you can't read the item, type the key name. See Applications.

  • Your team role decides what you can see: developers can't read prod secrets.
  • Each vault's drawer links to its Vault access log in Grafana (Monitoring).

TODO

Add step-by-step pages once the portal's Secrets screens are documented.