Secrets Management in Loft

Loft allows you to managed shared secrets that can either be retrieved via Loft CLI and kubectl, or they can be instantiated as synchronized Kubernetes secrets in namespaces and virtual clusters.

Creating Shared Secrets

1. Go to the Secrets view using the menu on the left
2. Click on the button
3. Use the Display Name field to define the name of this secret
4. Use the Secret Data textarea to add key: value pairs as secret data
5. OPTIONAL: Expand the Access To This Shared Secret section to configure who can view or edit this secret
6. Click on the button at the very bottom

Using Shared Secrets

Retrieve via Loft CLI

To retrieve the value of a shared secret using Loft CLI, run:

loft get secret [secret-name].[data-key]

Use In Kubernetes Secrets

1. Create a file named secret.yaml with content:

   apiVersion: v1
   kind: Secret
   metadata:
     name: my-secret
     labels:
       loft.sh/sharedsecret-name: my-shared-secret
       loft.sh/sharedsecret-namespace: loft
   type: Opaque

2. Create the Kubernetes secret using kubectl:

   kubectl apply -f secret.yaml

3. Shortly after creating the secret, Loft will populate the data of this secret with the data from our shared secret:

   kubectl get secret my-secret -o yaml

   Data Sync

   By default, Loft will update the data of this secret whenever the shared secret's data is updated. To disable this behavior, set the loft.sh/disable-sync: true annotation on the Kubernetes secret.

Access Permissions

1. In the Secrets view, hover over the secret that you want to give someone access to
2. While hovering over the row, you will see buttons appear on the right in the Actions column
3. Click on the button to Edit the secret
4. In the drawer that appears on the right, expand the Access To This Shared Secret section
5. If the user or team is not listed under Users & Teams yet, click the + Rule button to add another row for a new user or team
6. Use the Users & Teams field to select the Users and/or Teams who should get access to this app
7. Use the Permissions field to specify if a user is allows to view, update, ... this app definition
8. On the very bottom, click on the button to save the changes