docs
How to get kyvlt.sh’s secrets into the places that need them. Start with the concepts if you are new here; the Kubernetes pages assume them.
Concepts
What kyvlt.sh holds and who can read it.
- Projects and environmentsHow secrets are filed, and what a change to one affects.
- CollectionsGrouping keys so a reveal or a projection can take part of an environment.
- Values built from other valuesComposing a key out of keys you already have, anywhere in the organisation.
- Static and dynamic valuesWhich values kyvlt.sh can replace on a schedule, and why a value somebody else issued is not one.
- Service tokensThe credential a machine uses: one environment, read or write, shown once.
Kubernetes connector
Project an environment into your cluster as a Secret.
- What the Kubernetes connector isWhat it does, and why your cluster asks rather than kyvlt.sh reaching in.
- Installing itGetting the operator running, once, per cluster.
- Projecting an environmentYour first Secret: what lands, where, and what happens when a value changes.
- Scoping to collectionsProjecting part of an environment, and why the rest is never read.
- Changing key namesMaking keys match what an application expects, without touching a value.
- Authenticating as the clusterNo kyvlt.sh credential in your cluster at all.
- AssignmentsPoint an environment at a registered cluster; the operator wires it.
- Restarting workloadsKubernetes does not restart a pod when a Secret changes. How to ask it to.
Kubernetes troubleshooting
Every reason a sync can report, and where each one sends you.
GitHub Actions connector
Push a collection into a repository's Actions secrets.
- What the GitHub Actions connector isWhat it does, when it runs, and the one thing GitHub will not tell it.
- Connecting a repositoryCreating the app, installing it, and the two things you line up afterwards.
- What the screen can claimThe four states a key can be in, and why none of them is “in sync”.
- When a push failsEvery answer the GitHub connector can give, and where each one sends you.
Vercel connector
Push a collection into a Vercel project's environment variables.
- What the Vercel connector isWhat it does, where the values land, and what Vercel will not tell it afterwards.
- Connecting a Vercel projectMaking the token, choosing what it acts for, and the two things you line up afterwards.
- What the screen can claimThe states a key can be in, and why “in sync” is not one of them for a secret.
- When a push failsEvery answer the Vercel connector can give, and where each one sends you.