RUNNING

SecretReference

A SecretReference as RunningLake's configuration repository declares it, at secretreferences/<name>.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.

File: secretreferences/<name>.yaml

Fields

Field	Type	Required	Meaning
`apiVersion`	string	Yes	The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version). Values: `runninglake.io/v1alpha1`
`kind`	string	Yes	The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch). Values: `SecretReference`
`metadata`	object	Yes	No description
`metadata.name`	string	Yes	The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch).
`metadata.labels`	map of string	No	No description
`metadata.annotations`	map of string	No	No description
`spec`	object	No	SecretReferenceSpec is where a secret lives in your own store, AWS Secrets Manager or Vault, read inside your data plane. Nothing resolves a reference yet, so nothing reads the secret.
`spec.store`	string	No	Store is customer: your own store, read inside your data plane. runninglake is refused: secrets held by RunningLake are not offered.
`spec.provider`	string	No	Provider is aws-secrets-manager or vault. Leave it out when the plane has exactly one.
`spec.path`	string	No	Path is the secret's name in your store, such as payroll/warehouse-reader: segments of letters, digits and _+=.@- joined by /, at most 512 bytes. It may not begin RL_ or /, and a path that reads as a secret value is refused.
`spec.key`	string	No	Key is the JSON key inside the secret's value, such as password. Leave it out for a value that is a plain string.
`spec.version`	string	No	Version pins one version: an AWS version id, AWSCURRENT or AWSPREVIOUS, or a Vault KV version number. Leave it out for the current one.

A nested field is written with its parents, spec.a.b; an item of a list is [] and a value of a map is *. Required means the parent object must carry the field; the rules a schema cannot express, such as a field that is required only inside spec, are checked by rl diff.

The schema

This page is read from the kind’s published schema, at https://runninglake.com/schema/v1alpha1/secretreference.json. An editor that follows it checks a file of this kind as you type. To see the fields of a kind’s spec from the command line, run rl schema with the kind’s name: it works offline and prints what the gate accepts. The command reference has the rest.

All kinds