Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

type: genesissecret

A genesissecret Manifest is a Manifest type that reads a separately-written GenesisSecret YAML and generates Kubernetes Secrets using values retrieved from an external secret store (currently 1Password).

All that this Manifest type carries on the tazuna.yaml side is “which GenesisSecret YAML to read”. For the spec of spec.secrets / spec.outputs and so on inside it, see GenesisSecret schema.

path

Unlike other Manifest types, path points directly to a single YAML file, not a directory. Write it relative to the directory of tazuna.yaml itself.

manifests:
  - name: aws-credentials
    type: genesissecret
    path: ./genesissecrets/aws.yaml   # ← points directly at the file

Specific Fields

Written inside the manifests[].genesisSecret object.

In the current version this is an empty object with no fields. The field name is reserved for future extension.

manifests:
  - name: aws-credentials
    type: genesissecret
    path: ./genesissecrets/aws.yaml
    # genesisSecret: {}  # empty for now, no need to write it

Behavior

OperationInternal processing
BuildRead the GenesisSecret YAML, retrieve values from the Provider, and write a single Secret YAML (corresponding to outputs[0].kubernetesSecret) to stdout.
ApplyRead the GenesisSecret YAML, retrieve values from the Provider, and CreateOrUpdate a Kubernetes Secret for each entry of outputs[].kubernetesSecret.
DestroyRead the GenesisSecret YAML (Provider retrieval also runs), and delete the Secret matching namespace / name of each entry in outputs[].kubernetesSecret.

Build differs from Apply in that it outputs only the first entry of outputs (even when multiple outputs are written, tazuna build’s output is for one entry). See GenesisSecret - Resolution flow for details.

Relationship to State

Secrets generated by type: genesissecret are always handled as always-sync in tazuna state diff. They are not targets of ContentHash-based diffing; the Provider side is the source of truth and they are synchronized every time. See Internal Structure of State - Diff type and GenesisSecret - State and always-sync for details.