Secret Management — Overview
Two AWS accounts hold secrets: security-tooling (183184873475) for the handful that are genuinely org-wide, and each region's own workload account (dev-sgp is 941141114226) for everything else. "How populated" distinguishes who last wrote the value that's actually in AWS today:
- Terraform — Terraform itself generates and writes the value (e.g.
random_password), so it's populated the momenttofu applyruns. - Manual (shell) — Terraform creates the secret container with a placeholder/empty value; a human is expected to fill in the real value afterward, out of band (
ignore_secret_changes = trueso future applies don't stomp it). - RDS-managed — AWS itself creates and rotates the value (
manage_master_user_password); Terraform never sees the password. See Rotation & Rollout for how a rotated value actually reaches a running pod. - Untracked (drift) — a real value exists in AWS Secrets Manager with no Terraform resource creating it at all. Won't reproduce if the account/state is ever rebuilt.
Every secret is materialized into the cluster by ExternalSecrets (ESO) — see OpenBao for OpenBao's own secrets (TLS cert, SaaS admin token, agent mTLS PKI), which follow the same ESO pattern but are covered separately since OpenBao is both a secret consumer and, for tenant workspaces, a secret store in its own right.
Global (security-tooling)
| Secret | Consumer | How populated | Populated? |
|---|---|---|---|
github/cogrion/ssh-deploy-key | ArgoCD's clone of cogrion-gitops (write access) | Manual (shell) | Yes |
cogrion/cloudflare-client-certificates-secret | Inferred: Cloudflare mTLS client cert for edge auth to control-plane API — description predates the cogrion rename, unconfirmed | Manual (shell) | Yes |
cogrion/cloudflare/api-token | Cloudflare provider stage (infra/providers/cloudflare/main.tf, still stubbed, doesn't read from here yet) and cplane's CLOUDFLARE_API_TOKEN/CLOUDFLARE_ZONE_ID via cplane-secret's ExternalSecret | Manual (shell) | Yes |
cogrion/github-app/internal | Internal GitHub App — workspace-infra worker cloning platform tofu modules. Feeds cplane's GITHUB_APP_ID/GITHUB_APP_PRIVATE_KEY via cplane-secret's and cplane-github-key's ExternalSecrets | Manual (shell) | Yes |
cogrion/github-app/tenant | Tenant-facing GitHub App — cluster agent's git config. Feeds cplane's AGENT_GITHUB_APP_ID/AGENT_GITHUB_APP_INSTALLATION_ID/AGENT_GITHUB_APP_PRIVATE_KEY via cplane-secret's ExternalSecret | Manual (shell) | Yes |
cogrion/lambda-email | Mail relay for invite/provisioning emails — feeds cplane's LAMBDA_EMAIL_SEND_URL/LAMBDA_EMAIL_SEND_API_KEY via cplane-secret's ExternalSecret. Global, not per-region (one shared mail-relay service) — was originally modeled as a per-region shell (credentials/cplane/lambda-email), migrated here for the same reason as the GitHub Apps above (cogrion-terraform#117) | Manual (shell) | Yes |
Reader roles for the cogrion/* secrets include both cogrion-dev-sgp-* and cogrion-prod-sgp-* (account 536258239372) even though prod-sgp isn't stood up yet, so a region-specific reader doesn't need a separate PR later. Cross-account read access from dev-sgp's external-secrets IRSA role already exists (CrossAccountSecretsManagerRead + KMS decrypt in infra/modules/iam/main.tf, scoped to the cogrion/* prefix) — a cross-account ExternalSecret lookup needs the secret's full ARN, not just its name, since name-only lookups default to the caller's own account.
Per-region (dev-sgp)
| Secret | Consumer | How populated | Populated? |
|---|---|---|---|
cogrion-dev-sgp/database/{cplane,keycloak,temporal} | Each app's DB connection info (host/port/dbname/username — no password) | Terraform | Yes |
rds!db-<uuid> (one per RDS instance: cplane, keycloak, temporal) | Each app's DB master password, combined with the connection secret above via ESO templating | RDS-managed, rotates rate(30 days) | Yes |
cogrion-dev-sgp/admin/keycloak | Keycloak admin console password, wired to cplane's KEYCLOAK_ADMIN_PASSWORD | Terraform (random_password) | Yes |
cogrion-dev-sgp/openbao-server-secret | OpenBao's own TLS server cert/key | Untracked (drift) | Yes |
cogrion-dev-sgp/credentials/cplane/lambda-email | cplane's LAMBDA_EMAIL_SEND_URL/LAMBDA_EMAIL_SEND_API_KEY | Manual (shell) | Superseded — never populated, and never should be: this is one shared mail relay, not region-specific. dev-sgp's ExternalSecret still points here; prod-sgp's has been repointed at the global cogrion/lambda-email above. dev-sgp needs the same migration |
cogrion-dev-sgp/credentials/cplane/github-key | Internal GitHub App private key, mounted as a file (githubKey.secretName: cplane-github-key) | Manual (shell) | Superseded — same story as lambda-email above: one shared GitHub App, not region-specific. prod-sgp's ExternalSecret has been repointed at the global cogrion/github-app/internal above; dev-sgp hasn't been migrated yet |
cogrion-dev-sgp/credentials/cplane/vault-certs | cplane's trust of OpenBao's own TLS cert (NODE_EXTRA_CA_CERTS/VAULT_CA_BUNDLE_PATH, see OpenBao) | Manual (shell) | No — empty. Same gap was hit and fixed on prod-sgp (sparqd/control-plane#345); dev-sgp hasn't been populated yet |
cogrion-dev-sgp/credentials/cplane/vault-saas-admin-token | cplane's VAULT_SAAS_ADMIN_TOKEN, plus a duplicate in the openbao namespace (openbao-saas-admin-token) for the renewal CronJob | Manual (shell) — never Terraform-generated, minted via a live vault token create call | No, and shell not applied yet — see the exact mint/populate/renew sequence in the OpenBao page |
Not yet created (no AWS secret exists at all) — these env vars/features are blocked until a Terraform secret shell exists for them:
| Env var / feature | Blocks | Tracking |
|---|---|---|
BFF_TOKEN | BFF auth | cogrion-terraform#78 |
SMTP_* credentials | Email invitations, M365 decision pending anyway (#276) | not filed |
| dns-webhook's mTLS secret | External-DNS/Cloudflare webhook proxy mTLS | cogrion-terraform#78 |