Skip to main content
Version: Weekly Build

Private Cloud Installer Vault Secrets

prod.vault.yaml holds every secret the installation needs, either generated by oms init install-config or supplied by you. Each entry has either a file (a named file with text content, typically a PEM block) or fields (typically a password, and sometimes a username):

secrets:
  - name: <secretName>
    file:
      name: <filename>
      content: <pem-or-text>
  - name: <secretName>
    fields:
      password: <value>

Secrets OMS generates​

oms init install-config generates these automatically; you normally do not need to set them yourself: tokenPrivateKey, tokenPublicKey, cephSshPrivateKey, selfSignedCaKeyPem, domainAuthPrivateKey, domainAuthPublicKey, and, when PostgreSQL is installed by the installer, postgresPassword, postgresReplicaPassword, postgresPrimaryServerKeyPem, and postgresReplicaServerKeyPem.

Secrets you must supply​

SecretWhen requiredNotes
registryUsername, registryPasswordAlways for the GHCR-connected install pathSee Prepare the jumpbox and generate the configuration. The GHCR username goes in the password field.
kubeConfigUsing an existing Kubernetes cluster (kubernetes.managedByCodesphere: false)See Use an existing Kubernetes cluster.
acmeEabMacKeycodesphere.certIssuer.type: acme with EABSee Cluster ingress CA options.
githubAppsClientId / githubAppsClientSecretGitHub provider enabledSee Git providers.
gitlabAppClientId / gitlabAppClientSecretGitLab provider enabledSee Git providers.
bitbucketAppsClientId / bitbucketAppsClientSecretBitbucket provider enabledSee Git providers.
azureDevOpsAppClientId / azureDevOpsAppClientSecretAzure DevOps provider enabledSee Git providers.

Annotated example​

# prod.vault.yaml (before encryption — remove all comments before running sops)
secrets:
  # --- Common secrets, generated by "oms init install-config" ---
  - name: cephSshPrivateKey
    file:
      name: id_rsa
      content: |
        -----BEGIN OPENSSH PRIVATE KEY-----
        ...
        -----END OPENSSH PRIVATE KEY-----
  - name: selfSignedCaKeyPem # Or your own CA key, if bringing your own CA
    file:
      name: key.pem
      content: |
        -----BEGIN PRIVATE KEY-----
        ...
        -----END PRIVATE KEY-----
  - name: domainAuthPrivateKey
    file:
      name: key.pem
      content: |
        -----BEGIN EC PRIVATE KEY-----
        ...
        -----END EC PRIVATE KEY-----
  - name: domainAuthPublicKey
    file:
      name: key.pem
      content: |
        -----BEGIN PUBLIC KEY-----
        ...
        -----END PUBLIC KEY-----

  # --- Registry credentials, always required ---
  - name: registryUsername
    fields:
      password: 'YOUR_REGISTRY_USERNAME'
  - name: registryPassword
    fields:
      password: 'YOUR_REGISTRY_PASSWORD'

  # --- Only if postgres.mode: install ---
  - name: postgresPassword
    fields:
      password: 'YOUR_POSTGRES_ADMIN_PASSWORD'
  - name: postgresReplicaPassword
    fields:
      password: 'YOUR_POSTGRES_REPLICA_PASSWORD'
  - name: postgresPrimaryServerKeyPem
    file:
      name: primary.key
      content: |
        -----BEGIN RSA PRIVATE KEY-----
        ...
        -----END RSA PRIVATE KEY-----

  # --- Only if kubernetes.managedByCodesphere: false ---
  - name: kubeConfig
    file:
      name: kubeConfig
      content: |
        apiVersion: v1
        kind: Config
        clusters:
        - cluster:
            certificate-authority-data: ...
            server: https://<your-k8s-api-server>
          name: external-cluster
        contexts:
        - context:
            cluster: external-cluster
            user: external-admin
          name: external-context
        current-context: external-context
        users:
        - name: external-admin
          user:
            client-certificate-data: ...
            client-key-data: ...

Once generated and reviewed, encrypt this file — see Encrypt the secrets and configure DNS.