> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuon.co/llms.txt
> Use this file to discover all available pages before exploring further.

# 004 - Secrets Syncing

> Automatically sync customer secrets into Kubernetes

*May 10th, 2025*

<div className="badge badge--primary">v0.19.544</div>

## Customer Secrets

Customer input secrets can be defined in your `secrets.toml` config. This allows you to define secrets that need to be
added by users when provisioning an install via the CloudFormation stack.

You can define a secret with the following config:

```toml theme={null}
[[secret]]
name = "license_key_{{.nuon.id}}"
display_name = "license key for {{.nuon.id}}"
description = "License key"
```

Templating can be used on any field, allowing you to dynamically namespace secrets and other things. Since secrets are
synced *before* components are

<Note>`required` secrets will cause the CloudFormation Stack to fail, if not added.</Note>

## Auto Generated Secrets

You can automatically generate a secret value by adding the `auto_generate: true` field.

For instance, to create a unique value that is configured in your cluster:

```toml theme={null}
[[secret]]
name = "db_password_{{.nuon.id}}"
display_name = "Auto generated database password"
description = "Auto generated database password"

auto_generate = true
```

## Automatic Syncing

You can automatically sync secrets into your sandbox kubernetes cluster by adding the `kubernetes_sync: true` value to
your config.

```toml theme={null}
[[secret]]
name = "license_key_{{.nuon.id}}"
display_name = "License Key"
description = "License Key"

kubernetes_sync = true
kubernetes_secret_namespace = "{{.nuon.id}}"
kubernetes_secret_name = "database-password"
```

<Note>
  Syncing can be disabled via your config, and requires that correct permissions are enabled for the Provision role
  in your `permissions.toml`.
</Note>

## Outputs

You can use the outputs of a synced secret using the `{{.nuon.secrets}}` template. The values

If you *do not* see your secrets in `{{.nuon.secrets}}`, it means you do not have syncing on. You can reference the
source ARN directly using `{{.nuon.install_stack.outputs}}`.

<Note>
  If you are having trouble working with your state, we recommend adding it directly to your readme using the following block.

  ```toml theme={null}
  <details>
  <summary>Full Nuon State</summary>
  <pre>
  {{ toPrettyJson .nuon }}
  </pre>
  </details>
  ```
</Note>

<Note>Secret values are not available in your state, and can only be read from your application by using the source
secret (AWS Secrets Manager) or the Kubernetes secret directly.</Note>

## Life Cycle

Currently secrets are synced on `Provision`, `Reprovision` and `ReprovisionSandbox` workflows.

<Note>We currently do not automatically sync secrets. We are considering this for a future release</Note>

## Fixes

* Fixed an issue where terraform state was attempted to be displayed on all component types.
* Fixed a bug with dependency ordering.
* Fixed a bug in helm value templating.
* Fixed a bug where syncing an app with no installer, components or actions could fail.
* Fixed an issue where secrets would not sync when the kubernetes name was not valid.