Secrets and vault

Production deploys require an encrypted Ansible Vault file. Lab profile (fleet_profile: lab) allows placeholder defaults with warnings.

cp docs/vault.example.yml inventory/group_vars/all/vault.yml
./scripts/generate-vault-secrets.sh --encrypt --vault-pass-file ~/.umkim-vault-pass
export ANSIBLE_VAULT_PASSWORD_FILE=~/.umkim-vault-pass

Required keys (production)

Vault variable	Used for
fleet_lldap_jwt_secret_vault	Shared LLDAP JWT
fleet_lldap_admin_password_vault	LLDAP admin
fleet_console_auth_session_secret_vault	Console session signing
fleet_console_auth_admin_password_vault	Break-glass htpasswd
dcm_postgres_password_vault	DCM Postgres
harbor_admin_password_vault	Harbor admin
fleet_ingress_auth_*_vault	Authelia (when enabled)

vault.yml is gitignored. Commit only vault.example.yml. Store the vault password off-repo.

FLEET_PROFILE=production ANSIBLE_VAULT_PASSWORD_FILE=~/.umkim-vault-pass ./scripts/preflight-secrets.sh

Catalog instance secrets

Helm catalog password fields use x-sensitive + x-secret-bind. On Catalog → Deploy the console:

1. PUT /fleet/api/v1alpha1/catalog-instance-secrets — spoke Kubernetes Secret
2. POST /api/v1alpha1/catalog-item-instances — chart existingSecret refs only (no plaintext in DCM)

Dependent fields (x-ui-depends-on) appear directly under their controlling checkbox in the deploy wizard.