007 - Secret formats, bug fixes

May 24th, 2025

​

Secret Formats

Some complex secrets have formatting that can cause problems when being added to a CloudFormation stack. To enforce that a secret is base64 encoded, you can add the format: base64 field to a secret.

The following secret will be expected as a base64 encoded secret when inserted into the stack.

[[secret]]
name         = "github_app_key"
display_name = "GitHub App Key"
description  = "Github App Key for BYOC Nuon Install {{.nuon.id}}"
required     = true

kubernetes_sync             = true
kubernetes_secret_namespace = "ctl-api"
kubernetes_secret_name      = "github-app-key"
format = "base64"

The runner sync job will automatically decode the value based on the format when syncing into the Kubernetes secret.