004 - Secrets Syncing

May 10th, 2025

​

Customer Secrets

Customer input secrets can be defined in your secrets.toml config. This allows you to define secrets that need to be added by users when provisioning an install via the CloudFormation stack.

You can define a secret with the following config:

[[secret]]
name = "license_key_{{.nuon.id}}"
display_name = "license key for {{.nuon.id}}"
description = "License key"

Templating can be used on any field, allowing you to dynamically namespace secrets and other things. Since secrets are synced before components are

​

Auto Generated Secrets

You can automatically generate a secret value by adding the auto_generate: true field.

For instance, to create a unique value that is configured in your cluster:

[[secret]]
name = "db_password_{{.nuon.id}}"
display_name = "Auto generated database password"
description = "Auto generated database password"

auto_generate = true

​

Automatic Syncing

You can automatically sync secrets into your sandbox kubernetes cluster by adding the kubernetes_sync: true value to your config.

[[secret]]
name = "license_key_{{.nuon.id}}"
display_name = "License Key"
description = "License Key"

kubernetes_sync = true
kubernetes_secret_namespace = "{{.nuon.id}}"
kubernetes_secret_name = "database-password"

​

Outputs

You can use the outputs of a synced secret using the {{.nuon.secrets}} template. The values

If you do not see your secrets in {{.nuon.secrets}}, it means you do not have syncing on. You can reference the source ARN directly using {{.nuon.install_stack.outputs}}.

<details>
<summary>Full Nuon State</summary>
<pre>
{{ toPrettyJson .nuon }}
</pre>
</details>

​

Life Cycle

Currently secrets are synced on Provision, Reprovision and ReprovisionSandbox workflows.

​

Fixes

• Fixed an issue where terraform state was attempted to be displayed on all component types.
• Fixed a bug with dependency ordering.