Use a Secret

Overview¶

You never enter a secret value into your code or configuration. You create the secret once on the Kelvin Platform, then inject a reference to it with the <% secrets.secret-name %> syntax. Kelvin resolves that reference and injects the value at runtime.

There are a few places you can inject the reference:

• In the app.yaml file, before you upload the Application
• In the Configuration of the Application Settings, after the Application is uploaded
• In the Configuration of a workload when you deploy or update it
• In a secret volume, which delivers the value as a file inside the Workload

app.yaml Setup¶

This is the first way to use a secret, and it must be done before you upload the Application. You link the secret value on the Kelvin Platform to an Environment variable in the app.yaml file. Then you can access it like any normal Environment variable in any language.

1
2
3
4
5

defaults:
  system:
    environment_vars:
      - name: demosecret
        value: <% secrets.demosecret %> # notice the secrets prefix

Application Settings¶

A secret reference can also be injected dynamically after the Application is uploaded, without rebuilding or re-uploading it.

Open the Configuration section of the Application Settings, switch to the YAML editor, and enter the reference in place of the value.

1
2

exampleSecretKey: <% secrets.azure-client-secret %>
exampleStaticKey: exampleValue

Workload Configuration¶

A secret reference can also be injected into the Configuration of an individual workload when you deploy a workload or update a workload configuration.

Workloads are reachable from several places in the Kelvin UI:

• Clusters shows every workload running on a Cluster
• A Cluster Node shows every workload running on that Node
• Applications shows every deployment of that Application across all Clusters

These are different views of the same workload, not copies. A reference injected from one view is written to the same source, so it appears in all the others.

Mount as a File¶

From Kelvin 7.2 a secret can also be delivered as a file on disk instead of an environment variable or a configuration value, using the secret volume type. This suits software that will only accept a credential as a file, such as a TLS certificate or a database password file.

See Mount a Secret as a File for the full setup.

Python Example¶

1
2
3
4
5

import os

demosecret = os.environ.get("demosecret", "error!")

print(f'Your secret is {demosecret}')