Architecture: Secrets Pipeline

arch-secrets-pipeline Architecture

architecture

Architecture: Secrets Pipeline

How secrets flow from encrypted storage to running infrastructure. Established 2026-02-27 (Phase 2b), hardened 2026-03-14 (PR #45 — all 15 secrets onboarded).

Domain Map

What components exist and how they relate.

Data Flow

How a secret moves from creation to a running pod.

Deployment Map

Which secrets end up in which namespaces and services.

Secret Inventory (15)

Secret Namespace Delivery Origin Rotation
tailscale_oauth_client_id tailscale Helm set External (Tailscale console) None
tailscale_oauth_client_secret tailscale Helm set_sensitive External (Tailscale console) None
grafana_admin_password monitoring Helm set_sensitive Generated 90d
forgejo_admin_password forgejo Helm set_sensitive Generated 90d
woodpecker_forgejo_client woodpecker Helm set_sensitive External (Forgejo OAuth) None
woodpecker_forgejo_secret woodpecker Helm set_sensitive External (Forgejo OAuth) None
woodpecker_api_token monitoring k8s Secret (dora-exporter) External (Woodpecker UI) None
harbor_admin_password harbor Helm set_sensitive Generated 90d
harbor_secret_key harbor Helm set_sensitive Generated Never (data loss)
minio_root_password minio Helm set_sensitive Generated 90d
keycloak_admin_password keycloak k8s Secret (env ref) Generated 90d
paledocs_db_password pal-e-docs k8s Secret (DB URL) Generated 90d
slack_webhook_url monitoring Helm values (Alertmanager) External (Slack) None
telegram_bot_token monitoring Helm values (Alertmanager) External (BotFather) None
telegram_chat_id monitoring Helm values (Alertmanager) Config None

GPG Key

  • Key ID: 81A03D1CF874DC90
  • Identity: Salt Master (pal-e-platform)
  • Algorithm: RSA 4096
  • Backup: Private GitHub repo ldraney/secrets

Procedures

See sop-secrets-management for step-by-step procedures (adding secrets, rotation, recovery).
See README.md in forgejo_admin/pal-e-platform for the abbreviated adding-a-secret checklist.

Open Gaps

  • No rotation automation — registry tracks rotation_days but nothing enforces it
  • ~/secrets/ not backed up to MinIO — plaintext backup is local NVMe only
  • Phase 6.4 (CI apply-on-merge) — needs all 15 secrets as Woodpecker TF_VAR_* env vars. Not yet configured.
  • sop-secrets-management — procedures (public)
  • plan-pal-e-platform — parent plan
  • PR #45 — secrets onboarding (5 secrets + 1 registry fix)
  • PR #34 — Keycloak deploy (keycloak_admin_password origin)