Skip to content
UMKIMDocs

Secrets and vault

Experimental: operators remain responsible for secret confidentiality, rotation, and recovery.

Hub install requires an encrypted Ansible Vault. Start from docs/vault.example.yml, keep the live vault and password outside version control, and use an approved secret manager.

Terminal window
export ANSIBLE_VAULT_PASSWORD_FILE=<vault-password-file>
./scripts/preflight-v1.sh

Store directory, session, database, registry, ingress-auth, and backup credentials in the vault. Never put live values in inventory defaults, Markdown, issue trackers, CI logs, shell history, or image build arguments.

Helm values that contain passwords should be supplied through FleetApp valuesYaml only over the authenticated console or API. Prefer binding secrets on the spoke rather than leaving plaintext in the FleetApp object.

Do not handcraft API requests containing application passwords unless they are sent by an approved secret-aware client over an authenticated channel. Never copy a Kubernetes Secret value into a command, example, or ticket.

Spoke workload secrets remain on the cluster after hub detach; hub backup does not include spoke etcd or workload secrets. See backup and restore and console auth.