External Secrets
An external secret lets the platform fetch a credential from the secret manager you already run, instead of you pasting the value into a form. The secret of record stays in your provider; the platform holds a reference and the connection details needed to read it.
Find it under Settings → External Secrets.
Configuring one
Each external secret has three parts:
Backend — which provider to read from. The connection fields change with the backend you pick; for AWS Secrets Manager they are the Access Key ID, Secret Access Key, Region and the Secret Name.
Cluster — optional. Bind the secret to a specific cluster when only that cluster's workloads need it; leave it empty for an organization-wide secret.
Data mapping — which keys inside the secret become which files. Each entry maps a key to a file name, and those files are created at the target path where the workload can read them. A secret holding several credentials can therefore surface as several files rather than one blob.
Why use this instead of pasting a value
- The credential is never stored in the platform as a literal value you have to re-enter.
- Rotating in your provider propagates, rather than requiring an edit here.
- Access stays auditable in the system that already audits your secrets.
External Secrets sits behind an organization feature flag and requires an administrator seat. If the section is missing, it is not enabled for your organization.