Secrets¶

Declare secrets in stack.json or supply values from .stack.env at deploy time.

Declare a secret¶

Add an entry under resources.secrets[]. Provide either generate: true or a value. Then run kernstack deploy.

Field	Description
`name`	Secret name
`generate`	Set `true` to let the platform generate a random value
`value`	Literal value, `{{ref-env-file://KEY}}`, or `ref-secret://<id>`

generate and value are mutually exclusive.

On deploy, resolved values are stored in the environment and replaced with ref-secret://<id> in the canonical stack.

.stack.env:

DB_PASSWORD=replace-me

stack.json:

{
  "resources": {
    "secrets": [
      {
        "name": "db-password",
        "value": "{{ref-env-file://DB_PASSWORD}}"
      }
    ]
  }
}

kernstack deploy

Reference secrets in env vars with {{ref-secret-stack://name}}.