Sync Secrets Across Clusters

A kupe_secret resource does two things at once: it registers where the secret lives in the Kupe secret store, and it lists the cluster/namespace pairs it should sync to.

resource "kupe_secret" "db_password" {
  name        = "db-password"
  secret_path = "production/db-password"

  sync = [
    {
      cluster   = kupe_cluster.prod.name
      namespace = "backend"
    },
    {
      cluster   = kupe_cluster.staging.name
      namespace = "backend"
    },
  ]
}

You can override the Kubernetes Secret name in the target cluster with secret_name:

resource "kupe_secret" "api_token" {
  name        = "stripe-api-token"
  secret_path = "integrations/stripe"

  sync = [
    {
      cluster     = kupe_cluster.prod.name
      namespace   = "payments"
      secret_name = "stripe-credentials"
    },
  ]
}

The actual secret values are stored in the secret store, not in Terraform state. Set them via the console. See Manage Secrets via the API for the underlying model.