Architecture: Secrets Pipeline
Architecture: Secrets Pipeline
How secrets flow from encrypted storage to running infrastructure. Established 2026-02-27 (Phase 2b), hardened 2026-03-14 (PR #45 — all 15 secrets onboarded).
Domain Map
What components exist and how they relate.
Data Flow
How a secret moves from creation to a running pod.
Deployment Map
Which secrets end up in which namespaces and services.
Secret Inventory (15)
| Secret | Namespace | Delivery | Origin | Rotation |
|---|---|---|---|---|
| tailscale_oauth_client_id | tailscale | Helm set | External (Tailscale console) | None |
| tailscale_oauth_client_secret | tailscale | Helm set_sensitive | External (Tailscale console) | None |
| grafana_admin_password | monitoring | Helm set_sensitive | Generated | 90d |
| forgejo_admin_password | forgejo | Helm set_sensitive | Generated | 90d |
| woodpecker_forgejo_client | woodpecker | Helm set_sensitive | External (Forgejo OAuth) | None |
| woodpecker_forgejo_secret | woodpecker | Helm set_sensitive | External (Forgejo OAuth) | None |
| woodpecker_api_token | monitoring | k8s Secret (dora-exporter) | External (Woodpecker UI) | None |
| harbor_admin_password | harbor | Helm set_sensitive | Generated | 90d |
| harbor_secret_key | harbor | Helm set_sensitive | Generated | Never (data loss) |
| minio_root_password | minio | Helm set_sensitive | Generated | 90d |
| keycloak_admin_password | keycloak | k8s Secret (env ref) | Generated | 90d |
| paledocs_db_password | pal-e-docs | k8s Secret (DB URL) | Generated | 90d |
| slack_webhook_url | monitoring | Helm values (Alertmanager) | External (Slack) | None |
| telegram_bot_token | monitoring | Helm values (Alertmanager) | External (BotFather) | None |
| telegram_chat_id | monitoring | Helm values (Alertmanager) | Config | None |
GPG Key
- Key ID: 81A03D1CF874DC90
- Identity: Salt Master (pal-e-platform)
- Algorithm: RSA 4096
- Backup: Private GitHub repo
ldraney/secrets
Procedures
See
sop-secrets-management for step-by-step procedures (adding secrets, rotation, recovery).See
README.md in forgejo_admin/pal-e-platform for the abbreviated adding-a-secret checklist.Open Gaps
- No rotation automation — registry tracks rotation_days but nothing enforces it
- ~/secrets/ not backed up to MinIO — plaintext backup is local NVMe only
- Phase 6.4 (CI apply-on-merge) — needs all 15 secrets as Woodpecker TF_VAR_* env vars. Not yet configured.
Related
sop-secrets-management— procedures (public)plan-pal-e-platform— parent plan- PR #45 — secrets onboarding (5 secrets + 1 registry fix)
- PR #34 — Keycloak deploy (keycloak_admin_password origin)