Secrets

Store sensitive values once and sync them safely into managed clusters.

The model

Secrets in Kupe Cloud have two parts:

Storage in a tenant-isolated platform vault
Delivery into Kubernetes Secret objects in the clusters and namespaces you choose

Your team manages the source of truth in the platform; workloads still consume standard Kubernetes secrets in-cluster.

How it works

Secrets are stored in a dedicated vault that we manage for you, with each tenant in its own isolated namespace.

When you create or update a secret:

The value is stored in the platform vault.
You choose the clusters and namespaces that should receive it.
Kupe syncs the secret into those targets as a native Kubernetes Secret.
Your workloads consume it like any other Kubernetes secret.

Creating a secret and adding a sync target both take effect within seconds: the platform creates the sync definition and the secret lands in the target cluster straight away.

Changing the value of an existing secret is the slow case. Nothing about the sync definition changes when you edit a value, so the platform doesn’t notice immediately: it re-reads the vault on a 15-minute refresh interval, and there is no force-sync trigger today. Plan for a value change to take up to 15 minutes to reach your clusters.

Tenant isolation

Every tenant’s secrets are stored in a dedicated, isolated vault namespace:

Tenant separation: your secret data is not mixed with another tenant’s secret store
Scoped access paths: access is tied to tenant-scoped platform identity and sync flows
Encrypted storage: secret data is encrypted before it is written to storage

Sync rules

Secrets are delivered only where you tell the platform to send them.

A secret only reaches the clusters you configure.
Each sync target includes both a cluster and a namespace.
Updating a secret updates its synced copies.
Removing a sync target stops future sync to that target.
Deleting a secret removes it from the platform store, not from already-created Kubernetes secrets.

What your workloads receive

Kupe creates a standard Kubernetes Secret of type Opaque in the target namespace. The secret name matches the name you chose in the console, and every key you define becomes a data entry in that secret.

Your workloads use it the same way they would any other Kubernetes secret.

As an environment variable:

env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: db-credentials
        key: url

Or as a mounted volume:

volumes:
  - name: creds
    secret:
      secretName: db-credentials

Practical limits

Secret size is limited to ≈1 MiB per Secret object (all keys combined). This is the Kubernetes API object-size limit, so it applies when the secret is synced into a cluster rather than when it is stored in the vault
A secret can sync to up to 100 targets (cluster/namespace pairs)