SYS.DOCS // DOCS

Secrets Management

The Secrets page lists the Kubernetes Secrets of a cluster that deployments, apps and cron jobs read.

Path: Clusters → your cluster → Secrets

The page has two tabs:

Secrets lists two kinds of Secrets in one table:
- Secrets entered in Edka. You type the values or upload files.
- Synced secrets. External Secrets Operator fills them from an external secret manager, such as AWS Secrets Manager, HashiCorp Vault or Doppler.
Stores lists the connections to those secret managers.

Under the title, a line names the stores that are not connected and the synced secrets that fail to sync. Click one to open its tab. Connecting a store and syncing a secret are covered in External Secrets.

What this page lists

The Secrets tab lists the Secrets Edka created. They carry the label app.kubernetes.io/managed-by=edka. Secrets created another way, with kubectl, Helm or GitOps, do not appear here and can’t be changed from this page. Explorer shows every Secret of the cluster.

Show secret values

A Secret’s page lists its keys with the values masked. Owners and admins can click the eye next to a key to show its value, or Show values to show all of them, and copy a value once it is shown. Developers see the key names only.

When the organization requires passkey verification for protected reads, the first value shown asks for your passkey. The verification lasts 5 minutes for the session. Edka reads the values from the cluster when you show them, keeps no copy, and records who read which keys of which Secret.

The same applies to app credentials, database credentials and Explorer resource values.

List and filter secrets

Column	Shows
Secret	Name and namespace of the Secret. Click the name to open the Secret
Source	`Edka` for a Secret entered in Edka. For a synced secret, the store and what it reads
Keys	Key names. Hover to see all of them when the list is cut off
Status	For a synced secret, Synced with the time of the last read, Sync failing with the error on hover, or Waiting
Used by	Deployments that read the Secret as environment variables or mount it as files
Created	When the Secret was created

Synced secrets that fail to sync come first. The namespace filter switches between all namespaces and one active namespace, and the search box matches Secret names. Both apply to both kinds of Secrets. While a synced secret fails, Failing shows only the failing ones and All shows everything again.

Create a secret

Click Create secret to open the create flow.

You can add data in two ways:

Literal values (KEY=value pairs)
File contents (each file becomes a key)

Import is supported from .env, .json, .yaml, and .yml content.

Notes:

Secret type is created as Opaque.
Maximum file size is 1 MB per file.
At least one literal or file entry is required.

To fill a Secret from an external secret manager instead, click Sync a secret. It appears once a store is connected. See Sync a secret.

View and update secret keys

Open a Secret entered in Edka from the list to manage it.

The page shows the namespace, the deployments and cron jobs that read the Secret, its labels, and its keys. You can:

Change a value: click the pencil next to the key and enter the new value
Remove a key with the trash icon
Add keys with Add key, or Import them from .env, JSON or YAML
Show values, as Show secret values describes

Changes apply when you click Save. A key you don’t change keeps its value.

A synced secret opens its own page with its sync state, keys, the deployments and cron jobs that read it, and Sync now. Its values come from the provider, so you change them there. See The synced secret page.

Use a secret in a deployment or cron job

Both kinds of Secrets can be added to a deployment or cron job in the same namespace, and so can Secrets created outside Edka. Under Secrets from the cluster on the Envs & Secrets tab, every key becomes an environment variable. A Secret volume on the Storage tab mounts each key as a file. See Deployments and Cron Jobs.

Delete a secret

Delete a Secret from its row in the list or from its page, with a confirmation step.

A Secret that a deployment or cron job reads can’t be deleted. Edka names them, and in the list the delete button stays disabled. Remove the Secret from them first, under Secrets from the cluster or from a Secret volume.

Deleting a synced secret stops the sync and removes the Kubernetes Secret. The values in the provider stay.

Stores

The Stores tab lists the secret stores of the cluster.

Column	Shows
Store	Name and provider of the store. Click the name to change or delete a store Edka connected
Points at	Where the store reads from, such as the region, project, server or vault
Namespaces	Namespaces that may use the store, or `all`
Synced	How many synced secrets read from the store
State	Connected, Not connected with the error, or Waiting

A connected store has Sync a secret in its row. Click Connect store to add one. Stores created with GitOps or kubectl appear too, as “Created outside Edka”, and can’t be changed here. See Connect a store.

Archived clusters

When a cluster is archived, changes are blocked:

Create, update or delete a secret
Sync a secret
Connect, change or delete a store

Listing and metadata views remain available.