Overview

Secrets in InfraKitchen provide a secure way to manage sensitive configuration data required by your infrastructure resources. They enable safe storage and retrieval of credentials, API keys, and other sensitive values needed during resource provisioning.

What are Secrets?

A Secret in InfraKitchen is a secure storage mechanism that contains:

• Sensitive configuration values (passwords, API keys, tokens)
• Cloud provider secrets (AWS Secrets Manager, GCP Secret Manager)
• Custom key-value pairs for application configuration
• Provider-specific settings (regions, resource groups, account names)

All secret values are encrypted at rest using industry-standard encryption and are decrypted only when needed during resource provisioning.

Secret Properties

All secrets share common properties:

Secret Providers

InfraKitchen supports multiple secret storage providers:

Cloud-Native Providers

Custom Provider

How Secrets Work

Creation Flow

1. Create Secret → Choose provider and configure settings
2. Encryption → Values are encrypted using your encryption key
3. Storage → Encrypted data is stored in InfraKitchen database
4. Reference → Resources reference secrets in their configuration

Usage Flow

1. Resource Provisioning → Resource references a secret
2. Authentication → InfraKitchen authenticates to secret provider (if cloud-based)
3. Retrieval → Secret values are fetched and decrypted
4. Injection → Values are injected into OpenTofu/Terraform as variables (setup variables with TF_VAR_ prefix)
5. Cleanup → Decrypted values exist only in memory during execution

Managing Secrets

Create

Only platform engineers can create secrets:

1. Navigate to Secrets page
2. Click Create Secret
3. Select secret provider (AWS, GCP, or Custom)
4. Fill in required configuration fields
5. (Optional) Link to a cloud integration
6. Add labels for organization
7. Validate and save

Update

Secrets can be updated to modify values or configuration:

1. Edit existing secret
2. Update description or labels
3. Modify configuration (provider-dependent)
4. Save changes
5. Resources will use updated values on next provision

Delete

Before deletion:

• Ensure no resources reference it
• Update or destroy dependent resources
• Document the change
• Consider disabling instead of deleting

Disable/Enable

Secrets can be disabled without deletion:

• Disabled secrets cannot be used by new resource provisions
• Existing resources retain their configuration
• Can be re-enabled at any time

Provider-Specific Guides

Cloud Provider Secrets

• AWS Secrets Manager - AWS Secrets Manager integration
• GCP Secret Manager - GCP Secret Manager configuration

Custom Secrets

• Custom Secrets - InfraKitchen-managed key-value pairs

Troubleshooting

Common issues and solutions: