EnclaveStack
GitHubGet started

Secret stores

Secrets read from Vault, 1Password, AWS Secrets Manager, Doppler or Infisical.

Overview

A secret store connects EnclaveStack to where your team already keeps secrets. Secrets read from it are kept in sync and cached encrypted.

When to use it

  • Your team manages secrets in one of those stores.
  • Keys rotate there and your apps should follow.

How it works

Plain HTTP clients
Vault KV v2, 1Password Connect, AWS Secrets Manager, Doppler and Infisical through their HTTP APIs, without vendor SDKs.
Encrypted cache
Each value read is stored encrypted like any secret, so apps start even while the store can’t be reached.

Each secret that reads from a store is fetched again every refresh interval (5 minutes by default) and on Refresh now. If the store can’t be reached, the last value stays in use and the secret says why.

Architecture

Secret stores architectureValues are read from your store and cached encrypted.read every 5 minat startYour secret storeVault, 1Password…Control planeAPI · reconciler ·SQLiteEncrypted valueApps
Values are read from your store and cached encrypted.
  • Control plane to Your secret store: read every 5 min
  • Control plane to Encrypted value
  • Encrypted value to Apps: at start

Flows

Connecting Vault

  1. Store a Vault token as a secret.
  2. Create the secret store with the address and that secret, then Test.
  3. Create secrets that read their value from it.

Set it up

In the console

  1. Store the store’s token as a secret.
  2. Open Secret stores and choose New secret store.
  3. Use Test to check the connection.

With the CLI

enclave secretstore create team-vault --provider vault --address https://vault.example.com --token-secret vault-token

With OpenTofu

OpenTofu configuration
resource "enclave_secret_store" "team_vault" {
  name            = "team-vault"
  secret_provider = "vault"
  settings = {
    address     = "https://vault.example.com"
    tokenSecret = "vault-token"
  }
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

enclave_secret_store
NameTypeUseWhat it does
nametextrequiredName of the secret store: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the secret store.
secret_providertextrequiredvault, onepassword, aws, doppler or infisical ("provider" is reserved by OpenTofu). Changing it replaces the store.
settingsmap of textrequiredThe provider's settings, as the API names them: map[aws:[region credentialsSecret endpoint] doppler:[tokenSecret endpoint] infisical:[siteUrl projectId environment path credentialsSecret] onepassword:[connectUrl vault tokenSecret] vault:[address mount namespace tokenSecret]].
projecttextoptionalThe project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
refresh_secondsnumberoptionalHow often synced secrets are read again (60–86400; default 300).
idtextoutputResource ID.

Limits and security

Good to know

  • Refresh every 60 seconds to 24 hours.

Security

  • Store tokens are secrets themselves; values are cached encrypted.