Secrets

Properties

Property	Description	Values	Example
`secret` array	list of secrets Array of secret definitions that customers can provide during installation or that are auto-generated	Optional	-

`secret`

Property	Description	Values	Example
`name` string	secret name Identifier for the secret used to reference it via variable templating (e.g., {{.nuon.secrets.name}}). Supports templating	✅ Required	`"database_password"`, `"api_key"`
`description` string	secret description Detailed explanation of what this secret is for, displayed to users during installation	✅ Required	`"Master password for the database"`, `"API key for external service authentication"`
`display_name` string	display name Human-readable name shown in the installer UI. Supports templating	Optional	`"Database Password"`, `"API Key"`
`required` boolean	whether secret is required If true, customer must provide a value during installation. If false, can be skipped	Optional	-
`auto_generate` boolean	whether to auto-generate secret If true, a random secret will be generated if customer does not provide one. Cannot be used with required or default	Optional	-
`format` string	secret format Format of the secret value. Supported values: ‘base64’ for base64-encoded secrets, or empty for plain text	Optional	`"base64"`
`default` string	default value Default value used if customer does not provide one. Cannot be used with required or auto_generate	Optional	-
`kubernetes_sync` boolean	sync to Kubernetes If true, the secret will be synced to a Kubernetes Secret resource	Optional	-
`kubernetes_secret_namespace` string	Kubernetes namespace Kubernetes namespace where the secret will be created. Required if kubernetes_sync is true. Supports templating	Optional	`"default"`, `"{{.nuon.install.id}}-namespace"`
`kubernetes_secret_name` string	Kubernetes secret name Name of the Kubernetes Secret resource. Required if kubernetes_sync is true. Supports templating	Optional	`"app-secret"`, `"{{.nuon.install.id}}-secret"`
`kubernetes_sync_targets` array	Kubernetes sync targets List of Kubernetes destinations to sync this secret to. When present, Kubernetes sync is enabled. Each target writes the secret value into a given key of a named secret acro…	Optional	-