Secrets management

Backend choices

The umbrella chart supports four supply paths for ai-studio-secrets. Pick one.

Key inventory — 44 keys: 34 required, 10 optional

The mapping is defined in the umbrella chart's values.yaml under secrets.data. Convention: vault keys are kebab-case, Kubernetes Secret keys are snake_case. The platform reads only the Kubernetes side.

Database & cache — 3 keys

Application encryption & sessions — 6 keys

All six are required in every deployment.

Keycloak / OIDC — 6 keys

Keycloak SMTP — 8 keys

Required when Keycloak sends user email (verification, password reset). Set all eight together — Keycloak fails if any one is missing.

Azure services, Marketplace & AD federation — 8 keys

Azure-managed services — 3 keys

(Optional) Azure Marketplace — 2 keys

Consumed by genesis-tenant-mgmt for Azure Marketplace SaaS Fulfillment v2.

Azure AD federation — 3 keys

These configure end-user SSO via Azure AD as a Keycloak identity provider.

Gateway, service auth & data stores — 6 keys

(Optional) Observability & web tools — 5 keys

(Optional) LLM providers — 2 keys

The umbrella chart ships two optional mappings for LLM providers.

Manual creation — no ESO

Set global.secrets.externalSecrets.enabled: false and pre-create the Secret yourself.

kubectl create secret generic ai-studio-secrets \
  -n genesis \
  --from-literal=DB_USER='postgres' \
  --from-literal=DB_PASSWORD='<rotated>' \
  --from-literal=REDIS_PASSWORD='<rotated>' \
  --from-literal=SECRET_KEY='<32-rand-bytes>' \
  --from-literal=AUTH_SECRET='<32-rand-bytes>' \
  --from-literal=CREDENTIAL_ENCRYPTION_KEY='<32-rand-bytes>' \
  --from-literal=CREDENTIALS_ENCRYPTION_KEY='<32-rand-bytes>' \
  --from-literal=SECURITY_ENCRYPTION_KEY='<32-rand-bytes>' \
  --from-literal=SECURITY_ENCRYPTION_SALT='<16-rand-bytes>' \
  --from-literal=AUTH_KEYCLOAK_SECRET='<from-keycloak-client>' \
  ...   # repeat for all 34 required keys, plus any optional ones you enable

Generate random values with either of:

openssl rand -base64 32
python -c "import secrets; print(secrets.token_urlsafe(32))"

ESO + Azure Key Vault

The most common configuration.

# values-customer-acme.yaml
global:
  secrets:
    provider: "kubernetes"
    k8sSecretName: "ai-studio-secrets"
    refreshInterval: "1h"
    externalSecrets:
      enabled: true
    azure:
      vaultUrl: "https://kv-acme-prod.vault.azure.net/"
    secretStore:
      name: "genesis-secret-store"
      kind: "ClusterSecretStore"      
  managedIdentity:
    enabled: true
    provider: "azure"
    azure:
      clientId: "<workload-identity-client-id>"
      tenantId: "<aad-tenant-id>"
secrets:
  data:   
    - { secretKey: DB_USER, remoteKey: DB-USER }
    - { secretKey: DB_PASSWORD, remoteKey: DB-PASSWORD }
    - { secretKey: TEMPORAL_STORE_PASSWORD, remoteKey: DB-PASSWORD }
    - { secretKey: TEMPORAL_VISIBILITY_STORE_PASSWORD, remoteKey: DB-PASSWORD }
    ...   # repeat for all 44 mapped keys
  

Before you install, confirm:

1. Workload Identity federation between Azure AD and AKS is configured.
2. The genesis-platform-sa ServiceAccount carries the azure.workload.identity/use=true annotation.
3. The Azure AD app behind that ServiceAccount has get and list on the vault's secrets.
4. ESO is installed in the cluster.
5. Every key you leave in secrets.data exists in the vault with a value populated — the 34 required ones at minimum. The sync is all-or-nothing, so trim the mapping for any of the 10 optional keys you do not provision.

ESO + AWS Secrets Manager

global:
  secrets:
    externalSecrets:
      enabled: true
    aws:
      region: "us-east-1"
  managedIdentity:
    enabled: true
    provider: "aws"
  serviceAccount:
    aws:
      enabled: true
      roleArn: "arn:aws:iam::123456789012:role/genesis-platform-sa"

Before you install: IRSA is configured, and the role has secretsmanager:GetSecretValue and secretsmanager:DescribeSecret on the relevant secrets.

ESO + GCP Secret Manager

global:
  secrets:
    externalSecrets:
      enabled: true
  managedIdentity:
    enabled: true
    provider: "gcp"

Before you install: GKE Workload Identity binds the Kubernetes ServiceAccount to a Google service account holding roles/secretmanager.secretAccessor.

Rotation

Once ESO syncs a new value into the Secret, pods must roll to pick it up. ESO honours eso.external-secrets.io/refresh-time: "1h", so most rotations land within the hour unattended. Force it when you need immediate pickup:

kubectl rollout restart deploy -n genesis

Pre-production audit checklist

Keys are occasionally added or removed between releases. The authoritative per-release inventory ships with the release manifest; check it when upgrading rather than assuming this page's count.

See also