Secrets

Use secrets to conceal sensitive configuration from the deployment manifests.

Overview

When deploying applications you often end up specifying sensitive information in your deployment to enable secure database connections, providing API keys and other parameters that you normally wouldn't commit to the codebase. Synpse secrets decouples this configuration from your regular deployment files. Application spec can reference to secrets that were created in the same namespace.

Note: if you update secrets you will need to restart your applications for them to get the updated values.

Using secrets

You can view your existing secrets by selecting the namespace applications and then going to the secrets tab via the top toolbar:

Secrets tab will let you view, created, edit and delete existing secrets:

Creating a secret

Click on the "Create Secret" button if you want to add a new secret:

You can also use CLI to create a secret:

synpse secret create database-password --secret-value very-secret

Reference a secret from application spec

Secrets can be referenced as an environment variables in the application spec:

name: my-app
scheduling:
  type: AllDevices
  selectors: {}
spec:
  containers:
    - name: my-app
      image: my-organization/app:1.0.1
      env:
        - name: DATABASE_PASSWORD
          fromSecret: database-password

Never commit your secrets to git or GitHub, always reference them from the application spec to improve security.

Secret files

Secret maximum size is 100Kb

$ synpse secret create redis-config -f redis.conf

Secret can be used in application deployment by referring it in the spec

name: my-app
scheduling:
  type: AllDevices
  selectors: {}
spec:
  containers:
    - name: my-app
      image: my-organization/app:1.0.1
      secrets:
        - name: redis-config
          filepath: /path/to/redis.conf

File will be mounted to the Docker container and your application can read it from the specified file /path/to/redis.conf.