Changing key names

Applications have opinions about what their environment variables are called, and those opinions predate kyvlt.sh. Rather than editing the application, the projection can rename keys on the way out.

Apply a convention

apiVersion: connectors.kyvlt.sh/v1alpha1
kind: KyvltSync
metadata:
  name: kyvlt-secrets
spec:
  # <your-project> / <your-environment>
  environmentId: <your-environment-id>
  apiBaseUrl: https://api.kyvlt.sh
  tokenRef:
    name: kyvlt-token
  transform:
    nameTransformer: upperSnake
  intervalSeconds: 300

Every key arrives in that shape: database-url becomes DATABASE_URL.

The conventions are camel, upperCamel, lowerSnake, upperSnake, lowerKebab, tfVar for Terraform input variables, and dotnetEnv for .NET configuration nesting.

Rename one key

When a single key fits no convention, say so directly:

apiVersion: connectors.kyvlt.sh/v1alpha1
kind: KyvltSync
metadata:
  name: kyvlt-secrets
spec:
  # <your-project> / <your-environment>
  environmentId: <your-environment-id>
  apiBaseUrl: https://api.kyvlt.sh
  tokenRef:
    name: kyvlt-token
  transform:
    nameTransformer: upperSnake
    rename:
      stripe-key: STRIPE_SECRET_KEY
  intervalSeconds: 300

An explicit rename beats the convention, so the rest of the environment keeps following it.

Values are never changed

Renaming changes the name. A renamed key holds the same secret, so rotating it in kyvlt.sh still lands in your cluster.

There is no way to compute a value here — no concatenation, no templates — and there will not be. A derived value would be a new secret that exists only in your cluster, which nothing in kyvlt.sh could audit, rotate or revoke.

The one exception changes representation rather than content: a key can be base64-encoded for a consumer that expects it, and decoding gives back exactly what kyvlt.sh holds.

Two keys, one name

If a transform would give two keys the same name the sync is refused and both source keys are named. See NameCollision.

Keeping one quietly would lose the other, and it would surface much later as a workload missing a value.

A whole environment as one file

Some applications want a file rather than environment variables:

apiVersion: connectors.kyvlt.sh/v1alpha1
kind: KyvltSync
metadata:
  name: kyvlt-secrets
spec:
  # <your-project> / <your-environment>
  environmentId: <your-environment-id>
  apiBaseUrl: https://api.kyvlt.sh
  tokenRef:
    name: kyvlt-token
  transform:
    format: env
  intervalSeconds: 300

The Secret then holds a single entry containing every key in scope, in json, env or yaml. A name transformer still applies, to the names inside the file.