SYS.DOCS // DOCS

Secrets Management

Use the Secrets tab to manage Kubernetes secrets for a specific cluster.

Path: Clusters → your cluster → Secrets

What this page manages

The Secrets tab is scoped to Edka-managed user secrets only.

In practice, this means secrets with both labels:

app.kubernetes.io/managed-by=edka
edka.io/secret-type=user

Secrets without these labels are not listed and cannot be updated or deleted from this interface.

Protected secret access

Secret values are write-only in the Secrets workspace. Edka lists metadata and key names, but it does not show existing values when you open or update a secret.

Other protected reads, such as revealing app credentials, database credentials, or Explorer resource values, can require recent passkey verification. The verification is session-scoped and short-lived, so sensitive reads and shell-like access stay gated even after normal sign-in.

List and filter secrets

The list view shows metadata only:

Secret name
Namespace
Type
Key names (not values)
Creation time

Use the namespace filter to switch between all namespaces and active namespaces.

Create a secret

Click Create Secret to open the create flow.

You can add data in two ways:

Literal values (KEY=value pairs)
File contents (each file becomes a key)

Import is supported from .env, .json, .yaml, and .yml content.

Notes:

Secret type is created as Opaque.
Maximum file size is 1 MB per file.
At least one literal or file entry is required.

View and update secret keys

Open any secret from the list to manage it.

You can:

Review metadata (name, namespace, type, labels, annotations)
Replace values for existing keys
Add new keys
Remove selected keys
Import additional keys from supported formats

Important behavior:

Secret values are never displayed in the UI.
Existing values remain unchanged unless you provide a replacement.
Internal Edka labels are hidden in the detail display but still enforced server-side.

Delete a secret

Delete actions are available from both list and detail views for active clusters, with a confirmation step.

Archived clusters

When a cluster is archived, mutation actions are blocked:

Create secret
Update secret
Delete secret

Listing and metadata views remain available.