Scoping to collections

Most environments hold keys for more than one thing. A resource can project only the collections a workload needs, so the service that talks to the database does not also receive your payment keys.

Project only some of it

apiVersion: connectors.kyvlt.sh/v1alpha1
kind: KyvltSync
metadata:
  name: kyvlt-secrets
spec:
  # <your-project> / <your-environment>
  environmentId: <your-environment-id>
  apiBaseUrl: https://api.kyvlt.sh
  tokenRef:
    name: kyvlt-token
  scope:
    include: [database]
  intervalSeconds: 300

Only keys filed under database appear in the Secret. Everything else in <your-environment> is absent.

If most of the environment belongs and a little does not, say that instead:

apiVersion: connectors.kyvlt.sh/v1alpha1
kind: KyvltSync
metadata:
  name: kyvlt-secrets
spec:
  # <your-project> / <your-environment>
  environmentId: <your-environment-id>
  apiBaseUrl: https://api.kyvlt.sh
  tokenRef:
    name: kyvlt-token
  scope:
    exclude: [stripe]
  intervalSeconds: 300

Setting both is refused rather than resolved by a precedence rule you would have to remember. Keys filed under no collection are named (uncollected) and can be included or excluded like any other.

The keys outside the scope are never read

kyvlt.sh applies the filter. The operator does not fetch the whole environment and keep the part it wants, so values outside the scope are never sent, never reach your cluster, and never appear in your audit trail as having been read.

The difference is invisible in the result and decisive in an incident: after a token leaks, “what did this actually see” has an answer.

Changing your mind

Edit the scope and apply it again. The next sync converges: keys newly in scope appear, keys newly out of scope are removed, and the rest are untouched. Nothing needs deleting and recreating.

Removing a collection from the scope removes those keys from the cluster, which is how you take access away.

A collection that does not exist

The resource reports ScopeInvalid and projects nothing.

Treating an unknown collection as an empty one would turn a typo into a Secret with no keys and a workload that starts with nothing, explained nowhere.