Skip to content

Secrets Flow

Vault stores sensitive values outside Git. External Secrets authenticates to Vault with Kubernetes auth, reads approved values, and creates namespaced Kubernetes Secrets for workloads.

flowchart TB
    Admin[Operator CLI] --> Vault[Vault KV v2]
    ESO[External Secrets Operator] -->|Kubernetes auth| Vault
    Vault -->|approved secret data| ESO
    ESO --> Secret[Kubernetes Secret]
    Secret --> Cloudflared[Cloudflared]
    Secret --> Postiz[Postiz stack]
    Cloudflared --> Tunnel[Cloudflare Tunnel]
    Tunnel --> Service[Internal Kubernetes Service]

Ownership boundaries

  • Terraform under iac/vault owns Vault auth, mounts, policies, and roles.
  • The operator chooses or explicitly approves every application secret value.
  • Operators write approved application secret values to Vault through the Vault CLI.
  • External Secrets owns the generated Kubernetes Secret.
  • Workload manifests consume the Kubernetes Secret without embedding values.
  • Cloudflare owns the external tunnel endpoint and DNS routing.

Operator approval boundary

Declaring a Vault path in Git does not authorize creating or changing the value at that path. Before any credential generation, Vault write, rotation, deletion, secret read, or unseal operation, the exact action must be presented to the operator and must receive explicit approval. The operator must first be asked whether an existing value should be used.

Automation must not treat access to .env, a Vault token, or an unseal key as permission to use it. GitOps owns references and delivery; the operator owns the secret material and every security-sensitive mutation.

Application implementation

The Cloudflared deployment mounts the locally managed tunnel credential from a Kubernetes Secret. Its local configuration routes Linkding and returns a 404 response for unmatched hostnames. Postiz consumes Vault-backed JWT, database, and Redis credentials through namespaced Secrets. Optional provider credentials can be added later. OAuth tokens created after authorization remain in the Postiz PostgreSQL database.

See Vault, External Secrets, and Cloudflared for component details.