Store a secret (Key Manager)
The Secrets service, or Key Manager, stores sensitive values encrypted: passwords, API keys, encryption keys, and TLS
certificates. It keeps secrets out of your code and config files, released only to the services that need them.
Store a secret
1. Open the Secrets area of the console and create a secret.
2. Fill in:
- Name: a clear label, such as db-password.
- Payload: the secret value itself.
- Secret Type (if asked): opaque for a general password or token; other types cover keys and certificates.
- Content type: usually text/plain for a simple value.
3. Save it. It is encrypted at rest, so it is never written to disk in the clear.
Where secrets are used
- On their own, retrieved by name when a service or your team needs the value.
- Behind TLS certificates, where a certificate's private key is kept here.
- Behind encrypted volumes, where the encryption key is stored here rather than on the disk.
Treat retrieval like any sensitive action: give only the services and people that need a secret the access to read it.