Secrets

Store sensitive values in Kupe and deliver them as Kubernetes Secret objects to chosen clusters and namespaces.

Create and use a secret

1. Open Secrets in the console and select Create Secret.
2. Enter a name and key-value pairs.
3. Add the clusters and namespaces that should receive it. Create those namespaces first.
4. Wait for Synced, then use the secret in your workload.

env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: db-credentials
        key: url

See Create and sync secrets for the walkthrough.

Updates and removal

Value changes can take up to 15 minutes to reach your clusters. Check sync status before restarting workloads. Applications that read secrets from environment variables need a restart; mounted files update automatically, but your application must reload them.

Removing a target stops syncing. Deleting a secret in the console removes the Kupe copy. Already-synced Kubernetes Secrets remain in your clusters until you delete them separately.

A secret can have up to 100 targets. Keep each Kubernetes Secret below 1 MiB.