Secrets

The problem

A credential in a description is a credential in version control, in every backup of the store, and in every response that returns the description. Keeping it somewhere else solves that and creates two new problems: the material has to exist before the thing that reads it, and nobody can tell afterwards which deployments depend on it.

The second problem is what makes rotation frightening. If you cannot enumerate the readers, you cannot rotate without guessing who breaks.

How the platform solves it

A description references material; it never contains it. The reference is a path within the owning tenant’s own storage, and the value is resolved when the container is created. The description can be read, exported and committed without exposing anything.

You can supply or mint the material in the same request that references it. Material you provide inline is written to the store during admission and removed before the description is stored — what is kept is byte-identical to a reference-only description, and no route ever returns it. Material the platform mints is generated once per key and reused, so a later change to an unrelated field does not roll your database password.

A credential is named after the thing it belongs to, not after the deployment that reads it. That is what lets six deployments share one credential and one rotation. Naming by reader produced the same password written to several documents, and rotating one left the others serving the old value — so a credential claimed under two namespaces at once is refused, and the refusal names the other deployment and the single path to converge on.

The readers are derivable, not remembered. The platform can answer “which deployments read this credential” from the stored descriptions on every call, so the answer cannot go stale.

Rotation is an action, not a field. Rotating drifts the description’s hash, which replaces the container, which re-resolves the material. There is no counter in the manifest for you to set.

Not this

This page does not cover unsealing, policies or storage-engine operations. Those are operational procedures for the platform, not properties of a deployment.

It also does not enumerate the accepted path forms, the generation options or the rejection codes; those are generated into the reference, and a credential path restated in prose is a path that can disagree with the one the platform enforces.

Where to see it

• The secrets block, field by field: deployment manifest.
• Every refusal a path can earn: rejections and alterations.