Changelog

Deployer secrets

A secret input the customer's admin provides is now written into their own secret store, never sent to Alien:

alien.ts
ocrLicenseKey: alien.secret({
  providedBy: "deployer",
  required: true,
  label: "OCR license key",
  env: "OCR_LICENSE_KEY",
}),

The value lives in the deployment's deployer-secrets vault: SSM Parameter Store on AWS, Secret Manager on Google Cloud, Key Vault on Azure, or a Kubernetes Secret. Initial setup shows the secret's name in that store and the command to write it.

Alien checks only whether the secret exists. Until a required one does, the deployment waits in WaitingForSecrets and the workloads don't start. Workloads read the value at start with their own identity.

  • Local development: alien dev vault set deployer-secrets ocr-license-key --stdin
  • Delete: alien vault delete removes a secret from a deployment's vault
  • Not readable by management: the identity Alien uses to manage a deployment can't read its secrets

Read the docs →