kupe_secret

Manages a Kupe Cloud secret definition and its sync targets. Create and Update wait for the secret to reach phase=Active before returning; Delete waits for the underlying ManagedSecret CR to finish terminating. Timeouts are configurable via the timeouts block (defaults: create/update/delete 2m).

Example Usage

resource "kupe_secret" "app_config" {
  name        = "app-config"
  secret_path = "apps/app-config"

  sync = [
    {
      cluster   = "production"
      namespace = "hello"
    },
    {
      cluster   = "staging"
      namespace = "hello"
    },
  ]
}

Schema

Required

• name (String) Secret name (immutable after creation).
• secret_path (String) OpenBao KV v2 key path for the stored value. Immutable after creation.

Optional

• sync (Attributes List) Cluster/namespace targets to sync this secret to. (see below for nested schema)
• timeouts (Attributes) (see below for nested schema)

Read-Only

• created_at (String) Timestamp when the managed secret definition was created.
• etag (String) Resource version used for optimistic locking during updates.
• phase (String) Current sync phase for the managed secret.

Nested Schema for sync

Required:

• cluster (String) Target cluster name.
• namespace (String) Target namespace in the cluster.

Optional:

• secret_name (String) Override the K8s secret name (defaults to the managed secret name).

Nested Schema for timeouts

Optional:

• create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).
• delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
• update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

terraform import kupe_secret.app_config app-config