Secrets

Secrets allow you to configure Components with sensitive values and keys.

Secrets are defined with a secrets.toml and incorporated in the CloudFormation stack. This allows users to enter values when clicking on the stack link in the Nuon Dashboard, during the initial step of an Install where the Runner is created as a VM. Secrets are then stored in the user’s AWS Secrets Manager.

Secrets can be used to configure Components and Actions using variables.

​

How do you configure a Secret?

Within your App Config directory, create a file named secrets.toml. This file will contain the configuration for your Secrets. Alternatively, you can create a directory named secrets and place individual Secret files inside it, such as github_app_key.toml, vendor_license_key.

#:schema https://api.nuon.co/v1/general/config-schema?source=secrets

[[secret]]
name         = "github_app_key"
display_name = "GitHub App Key"
description  = "Base64 encoded Github App Key"
required     = true

kubernetes_sync             = true
kubernetes_secret_namespace = "control-plane"
kubernetes_secret_name      = "github-app-key"
format = "base64"

[[secret]]
name = "rds_secret"
display_name = "database password"
description = "database password"
required = true

[[secret]]
name = "vendor_license_key"
display_name = "Vendor license key"
description = "Vendor license key"
required = true

kubernetes_sync = true
kubernetes_secret_namespace = "app"
kubernetes_secret_name = "vendor-license-key"

Use the key-value pair kubernetes_sync = true to indicate that the Secret should be synced to Kubernetes as a Secret object. The kubernetes_secret_namespace and kubernetes_secret_name fields specify where the Secret will be created in Kubernetes.

​

Configuring Components with Secrets

Reference the Secrets from AWS Secrets Manager as outputs from the CloudFormation stack, and then use them in your Component config.

name              = "helm"
type              = "terraform_module"
terraform_version = "1.11.3"

[public_repo]
directory = "helm"
repo      = "your-org/your-repo"
branch    = "main"

[vars]
vendor_license_key = "{{ .nuon.install_stack.outputs.vendor_license_key_arn }}"

​

Configuring Actions with Secrets

Reference the Secrets from AWS Secrets Manager as outputs from the CloudFormation stack, and then use them in your Actions config. In this example, the secret is assigned to an Action environment variable and then referenced in a script. Note the script is stored in the src directory of the App Config.

[[triggers]]
type           = "post-deploy-component"
component_name = "rds_cluster"

[[steps]]
name    = "Copy RDS Secret for deployment"
command = "./rds_secrets/import.sh"

[steps.env_vars]
SECRET_ARN       = "{{ .nuon.install_stack.outputs.rds_secret_arn }}"

#!/usr/bin/env bash
secret_arn="$SECRET_ARN"

echo "[rds-secrets import] reading db access secrets from AWS"
secret=`aws --region $region secretsmanager get-secret-value --secret-id=$secret_arn`

​

Changing Secrets Outside of the App Config

If you need to change a Secret value outside of the App Config, e.g., in AWS Secrets Manager and use manual means to apply the Secret to your infrastructure, understand that Nuon will not detect the change. In order for Nuon to be aware of the change, you will have to either reprovision the Install or review the Dependency Graph in the Dashboard and manually reinstall the Components or Actions that depend on the Secret.