Overview

​

How it works

Qovery integrates with external secrets by deploying ESO (External Secrets Operator) in your cluster.

​

Configure a Secret Manager Access

You can configure a Secret Manager Access in the Add-ons section of your cluster. Select the guide for your secrets provider:

​

Reference the external secrets in your service

Once your cluster is deployed, you can link external secrets to any service:

• Open your service
• Navigate to the Variables tab
• Select the External secrets tab
• Click Add external secret

Qovery automatically lists the secrets available in your Secrets Provider to simplify setup: You can filter results by prefix to narrow the list: To create an external secret, you need to:

• Select the Secret Manager Access
• Select the secret from your Secret Manager
• Provide the environment variable key to inject

​

Using external secrets with Terraform services

Terraform services handle environment variables differently from other service types. Unlike application services where any environment variable is directly injected into the container, Terraform services expose variables through the Terraform variable system (TF_VAR_*). This means external secrets require a specific naming convention to be picked up correctly by Terraform at runtime. External secrets are supported only in the “External Secrets” tab:

• You can’t reference an external secret inside the “Terraform variables” section
• You can’t reference an external secret inside the “Terraform arguments” section

To inject external secrets into your Terraform workflows:

• The key of your external secrets must follow the pattern TF_VAR_${your_variable}
• You must not have an override of your_variable inside the “Terraform variables” from any file.tfvars