Skip to content
UMKIMDocs
Search limited to 0.1.0. Switch to the latest version for up-to-date results.

Secrets and vault

This content is for 0.1.0. Switch to the latest version for up-to-date documentation.

Use an encrypted Ansible Vault for hub bootstrap secrets. Keep the encrypted vault, its password material, WireGuard private keys, and generated bootstrap bundles out of source control and shared storage.

For the stricter configuration path, make the profile explicit during preflight:

Terminal window
FLEET_PROFILE=production \
  ANSIBLE_VAULT_PASSWORD_FILE=/secure/path/to/vault-password \
  ./scripts/preflight-v1.sh

This profile validates configuration; it does not imply production support.

Workload secrets

Section titled “Workload secrets”

For catalog fields using x-sensitive and x-secret-bind, the supported flow writes a Kubernetes Secret on the target cluster and gives DCM only an existing-secret reference. Do not put plaintext workload credentials in DCM values, API examples, terminal history, logs, or Git.

See Security and ports and App deploy and routes.