Sync Secrets Across Clusters

A kupe_secret resource does two things at once: it registers where the secret lives in the platform vault, and it lists the cluster/namespace pairs it should sync to.

resource "kupe_secret" "db_password" {
  name        = "db-password"
  secret_path = "shared/db-password"

  sync = [
    {
      cluster   = kupe_cluster.production.name
      namespace = "backend"
    },
    {
      cluster   = kupe_cluster.staging.name
      namespace = "backend"
    },
  ]
}

You can override the Kubernetes Secret name in the target cluster with secret_name:

resource "kupe_secret" "api_token" {
  name        = "stripe-api-token"
  secret_path = "integrations/stripe"

  sync = [
    {
      cluster     = kupe_cluster.production.name
      namespace   = "payments"
      secret_name = "stripe-credentials"
    },
  ]
}

The actual secret values are stored in the vault, not in Terraform state. Set them via the console or the API. See Manage Secrets via the API for the underlying model.