Secrets management where passwords never sit in plain text again

• What is the difference between a variable and a secret?

  A variable stays readable in the cockpit – a feature flag or a URL, for example. Once saved, a secret can only be overwritten: no interface returns the value, not even for administrators. The choice is made when it is created.

• Can I turn an existing variable into a secret?

  Yes. The lock on its row converts it; the value stays the same and is never shown again. For variables with names like APP_KEY, *_PASSWORD or *_TOKEN, the card points this out on its own.

• Where are secrets stored without the Secret Manager?

  In your workspace’s database, encrypted with AES-256-GCM and a key that belongs to your workspace alone. That is enough for many teams; the Secret Manager comes in when you want versions and visibility in the Scaleway console.

• What permissions does the Scaleway key need for the Secret Manager?

  A project IAM key with access to the Secret Manager. Clusterward verifies it before saving and creates secrets under /bk-operator/<App>/<Environment>/<Service>. If you rename something, the secrets move to the matching folder.

• What happens when I rotate a secret in the Scaleway console?

  Clusterward notices the new version within ten minutes. The service shows “Restart pending” and a notification goes out. With the checkbox ticked, the service restarts on its own and then runs with the new version.

• Do I need the External Secrets Operator?

  No. Without it, Clusterward reads the value at deployment and writes the Kubernetes Secret itself. With it, the operator syncs inside the cluster, and Clusterward triggers a sync on every deployment and waits for it. The choice applies per cluster.

• How do I keep passwords out of Helm values?

  Via the “Chart secrets” card on the Helm service. There you create the secret and write ${secret.NAME} into the values. Clusterward inserts the value masked on every deployment and never stores it in the values.

• Can I use secrets that already exist in the Secret Manager?

  Yes, by ID or by path and name. Clusterward only references them: it writes no versions and never deletes them. It still notices rotations you make in the console.

• Can I move an existing secret to the Secret Manager?

  Yes. In its row on the Environment variables card, choose “Move to Secret Manager…” and select the store. The value moves, the workspace database keeps only the reference, and the next deploy or restart reads it from the store.

Can’t find your question? Write to us – we usually reply on the same business day.