Configuration and secrets

Where the running configuration comes from once it stops being a file on disk, and where credentials go instead of into it.

More than one writer, one document

A cluster’s configuration is composed from named sources, each owned by whoever writes it. An operator reconciling Kubernetes objects, a human editing in the console and Terraform running in CI are three writers who would otherwise overwrite each other’s work with every apply. → Manage the configuration through the API

Terraform is one of those writers rather than the owner of the whole document. That lets it manage providers and budgets without taking custody of everything else. → Manage the deployment with Terraform

Credentials do not go in the document

${secret:NAME} is written once, from the console, the API or an environment, sealed into the raft log, resolved at load, and never read back. A literal credential in a source is refused, not warned about. → Store a secret through the API

The key that seals them is itself rotatable, in three steps that never leave the cluster unable to read what it already wrote: add a wrapping, roll, drop. → Rotate the cluster secret

And no admin secret at all

This section does not cover a credential for reaching the admin API, because there is not one. There is no shared token to distribute, store or rotate. Signing in runs against the same identity provider everything else on the admin plane does, see Admin access.