Ops platform / Resources
Secrets
Secret groups hold the variables a service gets when it starts.
A secret group is a set of variables in one environment. A service names its group as
env_group, and gets the group's variables when it starts. Values live in ops and never in
your repository, a spec or the audit log.
Two kinds of variable
| kind | shown again | use it for |
|---|---|---|
| secret | never, not in the console, the CLI or the API | passwords, keys, tokens |
| text | yes | settings that are not secret, such as a log level |
Setting variables
Open Secrets. Each group is a table you edit in place: Add variable, type the name
and the value, and choose its kind. A name is A to Z, 0 to 9 and _, starting with
a letter.
From a terminal:
ops secrets list api # names, kinds, and the text values
ops secrets set api PAYMENT_KEY=... # a secret
ops secrets set api LOG_LEVEL=debug --text # a text variable
ops secrets set api LOG_LEVEL=debug --text --env staging
A change reaches the service when you render
Setting a variable does not restart anything. The group shows how many changes wait, and Render writes the next version and restarts the services that mount it. From a terminal that is:
ops secrets rotate api
The section under the groups lists every version rendered so far.
Variables ops writes for you
Some variables in a group belong to another resource: a database's connection string, a bucket's keys, a service's public address. Ops writes them and updates them, and they are not yours to edit.
A local env file
ops env pull writes the text variables of a group to a file. Secret values are never
exported: each one becomes a commented line naming where its value comes from.
ops env pull --group api -o .env # production
ops env pull --group api --env development -o .env
ops env pull --fail-on-secrets # exit 1 when the group holds secrets
--group may be left out while the environment has one group.