Skip to content

Secrets management

Status: Current | Last reviewed: 2026-05-28

How secrets land in cluster pods on each cloud target.

What needs to be a secret

Secret Purpose
trueserve-master-key MASTER_ENCRYPTION_KEY — see secret-storage.md
trueserve-postgres DATABASE_URL credentials
trueserve-redis Redis password (if not auth-disabled)
trueserve-rabbitmq RabbitMQ creds
trueserve-object-store S3/Blob/GCS access keys (where applicable)
trueserve-collab-token COLLAB_SERVICE_TOKEN shared between ai-manager and collab-gateway
trueserve-oidc Authentik client secret
Per-integration Tenant credential blobs encrypted with MASTER_ENCRYPTION_KEY

Patterns by cloud

AWS

Use external-secrets-operator with SSM Parameter Store or Secrets Manager.

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: trueserve-master-key
  namespace: trueserve
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: aws-secrets-manager
  target:
    name: trueserve-master-key
  data:
    - secretKey: MASTER_ENCRYPTION_KEY
      remoteRef:
        key: trueserve/customer-prod/master-encryption-key

GCP

Use external-secrets-operator with Google Secret Manager, or the Secret Manager CSI driver for direct mounts.

Azure

Use the Azure Key Vault Provider for Secrets Store CSI Driver.

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: trueserve-master-key
  namespace: trueserve
spec:
  provider: azure
  parameters:
    keyvaultName: trueserve-customer-prod
    objects: |
      array:
        - |
          objectName: master-encryption-key
          objectType: secret
    tenantId: <azure-tenant-id>

Self-hosted

Use Sealed Secrets (Bitnami) or Vault Agent Injector. Sealed Secrets is simpler when there's no central Vault.

Loading into pods

Every chart subchart accepts a secretRefs: list:

ai-orchestrator:
  secretRefs:
    - name: trueserve-master-key
      keys: [MASTER_ENCRYPTION_KEY]
    - name: trueserve-postgres
      keys: [DATABASE_URL]

The chart injects them as envFrom.secretRef.

Rotation

Rotation policies vary by secret. The MASTER_ENCRYPTION_KEY in particular requires a controlled rotation that re-encrypts every row. See the rotate-master-encryption-key runbook.

See also