Overview
Pulls keys, passwords, and other sensitive values from an external secret store.
Description
Configuring a Secret source means you don’t have to place these values in your configuration directly. This is similar to the way you can reference environmental variables. Secrets loaded in this way are never written to disk. Properly externalizing secrets allows you to place your configuration into source control without modification.
Once a Secret source is configured, you can utilize it by including a configuration value like secret.key-name. The secret source will then be queried for a secret named key-name. If the secret store has no secret by that name, it will prevent the application from starting up. This effect applies to any other "entity" (cache, authentication, provider), for obvious reasons you can’t use a secret in the configuration for your secret source.
Secret values are resolved when the application starts and when the configuration is reloaded. Tilegroxy can watch for changes to your secrets, which will trigger a zero-downtime reload (this reloads all secrets (and everything else), not just the one that changed). This is controlled by the watch parameter and defaults off (this is independent of --hot-reload cli flag for configuration hot loading).
Choosing a secret source
| Goal | Secret source | Notes |
|---|---|---|
Store secrets in AWS |
Caches values until the next reload. Can detect rotated secrets with |
Configuration
| Parameter | Description | Type | Required | Default |
|---|---|---|---|---|
|
Whether to check watched secrets for changes and reload when one of them rotates |
bool |
No |
false |
|
How often to check for changes, in seconds. Only valid when watch is true |
int |
No |
300 |
|
How often to reload all secrets regardless of whether a change was detected, in seconds. Disabled when 0. Only valid when watch is true |
int |
No |
0 |