External secret managers
Resolve integration credentials from approved providers without copying long-lived values into definitions.
External secret references let an authorized Infra consumer obtain credentials from a configured secret manager. The reference records provider, path, version selection, and permitted consumers.
Configure a provider
Under Settings → Secret providers, register the endpoint, trust chain, authentication method, and namespace. Use a dedicated provider identity limited to the required paths. Test resolution from the actual consumer network path.
Provider credentials must be recoverable through the installation's approved incident procedure. Hosting the only bootstrap credential inside the same unavailable provider can prevent control-plane recovery.
Reference and version policy
A reference can pin an immutable provider version or follow its approved current alias. Pinning supports reproducible deployment; following an alias permits rotation without editing every resource definition.
Consumers record the resolved version they actually used. After changing an alias, read the secret's consumer results to compare the requested and observed versions. For a backup destination, apply the reference through Update credentials and run its capability test. Keep the previous credential valid until transfers still using it finish.
Caching and failure
A provider configuration can permit bounded caching of a resolved credential. The effective cache policy and expiry appear on the consumer. After usable cache expires, a failed resolution rejects the operation rather than substituting an empty credential.
Revocation at the provider and revocation of an Infra reference have different visibility timing. Do not assume an external value was erased from every active consumer immediately after a path is disabled.
Guest workloads
An integration credential resolved for a backup worker is not automatically available to guests. Guest delivery needs an explicit workload identity and permitted consumer path. User data and image capture remain unsuitable storage for long-lived application secrets.
Retire
Replace consumer references, verify the new provider version, resolve active operations, and revoke the old provider identity. Deleting a reference does not delete the original provider secret or copies retained under its audit policy. See Secret API, volume encryption, and brokered sessions.