Reference global secrets

Template-time resolution (${}):

${secrets.<SECRET_ID>.values.<KEY_PATH>}
${secrets.<SECRET_ID>.files.<FILE_ID>.path}

Values are replaced when the template runs and appear in template run logs.

Runtime resolution (${{}}):

${{secrets.<SECRET_ID>.values.<KEY_PATH>}}
${{secrets.<SECRET_ID>.files.<FILE_ID>.path}}

Values are resolved when containers start and do NOT appear in template run logs. Use this for sensitive data.

Use dot notation to access nested values:

{
  "runtimeEnvironment": {
    "DATABASE_HOST": "${secrets.db-config.values.DB_HOST}",
    "DATABASE_PORT": "${secrets.db-config.values.DB_PORT}",
    "DATABASE_PASSWORD": "${{secrets.db-config.values.DB_PASSWORD}}"
  }
}

Arrays can be referenced directly:

{
  "ports": [{
    "security": {
      "policies": [{
        "addresses": "${secrets.network.values.allowedIPs}",
        "action": "ALLOW"
      }]
    }
  }]
}

Use all values

Whole-object references resolve when the template runs, and the values appear in template run logs. For runtime resolution, reference individual values instead.

Assign the whole values object to a resource node's buildArguments to use every entry as a build argument:

{
  "buildArguments": "${secrets.build-config.values}"
}

For runtime variables, use "runtimeEnvironment": "${secrets.build-config.values}" instead. Build arguments and runtime variables are separate. Setting one does not set the other.

Use valid variable names with string, number, or boolean values. Nested objects and arrays fail validation. Reference secret files separately. A whole-object reference assigns the entire field.

Reference files using their identifier (not path):

{
  "runtimeFiles": {
    "/etc/ssl/cert.pem": {
      "data": "${secrets.ssl-certs.files.cert.data}",
      "encoding": "utf-8"
    },
    "/etc/ssl/key.pem": {
      "data": "${{secrets.ssl-certs.files.key.data}}",
      "encoding": "utf-8"
    }
  }
}

The Secret Inheritance node allows you to merge multiple global secrets in a specific order within your template. The node returns merged values and files. It does not inject them into subsequent resources.

How it works

Add a Secret Inheritance node to your template:

{
  "kind": "SecretInheritance",
  "ref": "merged-config",
  "spec": {
    "secrets": [
      "base-secrets",
      "override-secrets"
    ],
    "requiredKeys": [
      "API_KEY",
      "DATABASE_HOST"
    ]
  }
}

Secrets are merged in order. Later secrets override matching values, and nested objects are merged.

Accessing merged data

Run the inheritance node before resource nodes that reference its output. Merged values resolve when the template runs and appear in template run logs. For runtime resolution, reference individual global secrets directly instead.

Map individual merged values into a resource node:

{
  "runtimeEnvironment": {
    "API_KEY": "${refs.merged-config.values.API_KEY}",
    "DB_HOST": "${refs.merged-config.values.DATABASE_HOST}"
  }
}

To use all merged values as build arguments, set:

{
  "buildArguments": "${refs.merged-config.values}"
}

Use runtimeEnvironment instead for runtime variables. The same value requirements apply.

To share the values across resources, populate a project secret group. Services and jobs inherit its variables according to the group's scope and restrictions.

Required validation

Specify requiredKeys and requiredFiles to enforce that critical configuration is present in the merged result. The template run will fail if any required items are missing.

When using the visual template editor, file encoding fields may be removed on save. Use the code editor for custom encoding values or dynamic file paths.