Secrets Manager Secrets Reference

Define AWS Secrets Manager secret names and map them in global.remoteSecrets before your first Helm deploy of chart bighammer 1.0.12+.

Secret names are not secret values

This page lists Secrets Manager secret names (identifiers). These are not passwords. Store actual values only in Secrets Manager; never commit them to Git or Helm values files.

The chart maps Secrets Manager names → Kubernetes Secret keys via External Secrets Operator (ExternalSecret per service). Defaults / samples live in the chart overlays (values-release.yaml, values-dev.yaml). Override names in your values-<env>.yaml.

Related: v1.0.12 Release · Platform Deployment · POC Setup (K3s) · Azure Key Vault equivalent: Key Vault Secrets

Flow

Platform prerequisites — DB passwords (and optional SSL material) exist in Secrets Manager.
One-time application secrets — create the secrets listed below (console, IaC, or CLI).
SecretStore (aws-secret-store) authenticates with IRSA (or static credentials only if you deliberately configure them).
ExternalSecret per service syncs into K8s Secrets.
Pods consume env vars or mounted files.

ESO fails the entire secret on the first missing key

If any remoteRef.key does not exist in Secrets Manager, the ExternalSecret stays in SecretSyncedError and the pod often hits CreateContainerConfigError (secret "…" not found).

Initial secrets checklist (create these first)

Derived from all ExternalSecret templates under charts/*/templates/secret.yaml and global.remoteSecrets in the AWS chart overlays.

A. Platform / database (required)

Secrets Manager name (recommended)	Chart path (`global.remoteSecrets…`)	Used as (K8s key)	Purpose
`bh-dev-user-password`	`postgres.password`	`POSTGRES_PASSWORD`	PostgreSQL role `bh_dev_user` (migrations / Alembic)
`bh-app-user-password`	`app.userPassword`	`BH_APP_USER_PASSWORD`	PostgreSQL role `bh_app_user` (runtime DML)
`bh-kcdbpwd`	`keycloak.dbPassword`	`KC_DB_PASSWORD`	Keycloak server DB user `keycloak_db_user`
`bh-rdsssl` (or placeholder PEM)	`postgres.clientCert`	`POSTGRES_SSL_CERT`	RDS SSL material when `postgresSSLMode` requires it; may be a dummy PEM if SSL files unused

Sample chart overlays may still use legacy names such as rds/master/password or bh/rdsssl — override to your naming standard in values-<env>.yaml.

B. One-time application secrets (required)

Secrets Manager name (recommended)	Chart path	Used as (K8s key)	Purpose
`bh-kcadminpwd`	`keycloak.adminPassword`	`KEYCLOAK_ADMIN_PASSWORD`	Keycloak admin UI password
`bh-keycloak-grant-type`	`keycloak.grantType`	`KEYCLOAK_GRANT_TYPE`	OAuth grant type (often `password`)
`bh-temp-tenant-user-password`	`keycloak.tempTenantPassword`	`TEMPERORY_TENANT_USER_PASSWORD`	Temporary tenant user (Keycloak API)
`bh-rabbitmq-password`	`rabbitmq.password`	`RABBITMQ_PASSWORD`	Must match the `bhrabbitmq` broker password
`bh-redis-password`	`aiagent.redisPassword`	`REDIS_PASSWORD`	Redis / Celery result backend
`bh-langchain-api-key`	`aiagent.langchainApiKey`	`LANGCHAIN_API_KEY`	LangChain / LLM observability
`bh-catalog-decryption-key`	`catalog.decryptionKey`	`DECRYPTION_KEY` / `VITE_DECRYPTION_KEY` / `NEXT_PUBLIC_DECRYPTION_KEY`	Catalog / UI decryption
`license-catalog`	`catalog.license`	`LICENSE`	Catalog license string
`license-catalog-pub-key`	`catalog.licensePubKey`	`PUBLIC_KEY`	Catalog license public key
`bh-oauth-token`	`audit.oauthToken`	`OAUTH_TOKEN_SECRET`	Audit API OAuth token

C. AWS credentials injected into pods (required by current images)

Several services require static env keys (they do not rely on IRSA alone):

Secrets Manager name	Chart path	Used as (K8s key)	Purpose
`AWS_ACCESS_KEY`	`app.awsAccessKey`	`AWS_ACCESS_KEY` / `AWS_ACCESS_KEY_ID`	App AWS API access
`AWS_SECRET_ACCESS_KEY`	`app.awsSecretAccessKey`	`AWS_SECRET_ACCESS_KEY`	App AWS API secret

Store as plaintext Secrets Manager secrets (raw key strings). Prefer least-privilege IAM users; rotate regularly.

D. TLS PEMs for Ingress (when `ingress.tlsEnabled: true`)

Secrets Manager name (example)	Chart path	Used as	Purpose
`<env>-aws-bighammer-tls-crt` or `wildcard-<env>-bighammer-crt`	`tls.cert`	`tls.crt`	Ingress / UI TLS certificate PEM
`<env>-aws-bighammer-tls-key` or `wildcard-<env>-bighammer-key`	`tls.key`	`tls.key`	Matching private key PEM

If TLS terminates only on the ALB (ACM) and you set tlsEnabled: false, remove TLS entries from the UI ExternalSecret or keep dummy PEMs so ESO can still sync other keys in the same secret. ACM cannot export a private key into Secrets Manager.

E. Optional

Secrets Manager name	Chart path	Purpose
`aws-ecr-docker-config`	`ecrImagePullSecret.key`	Dockerconfig JSON for private ECR pull (often replaced by a CronJob-refreshed K8s secret)

Chart defaults vs sample overlays

Values path	Recommended SM name	`values-release.yaml` sample	`values-dev.yaml` sample
`postgres.password`	`bh-dev-user-password`	`rds/master/password`	`rds/master/password`
`postgres.clientCert`	`bh-rdsssl`	`bh/rdsssl`	`bh/rdsssl`
`app.userPassword`	`bh-app-user-password`	`bh/appuserpwd`	`bh/appuserpwd`
`rabbitmq.password`	`bh-rabbitmq-password`	`bh/rabbitmqpwd`	`bh/rabbitmqpwd`
`catalog.decryptionKey`	`bh-catalog-decryption-key`	`bh/catalogdecryption`	`bh/catalogdecryption`
`catalog.license`	`license-catalog`	`license-catalog`	`license-catalog`
`catalog.licensePubKey`	`license-catalog-pub-key`	`bh-eks-prod`	`bh-eks-dev`
`audit.oauthToken`	`bh-oauth-token`	`bh-oauth-token`	`bh-oauth-token`
`aiagent.redisPassword`	`bh-redis-password`	`bh/redispwd`	`bh/redispwd`
`aiagent.langchainApiKey`	`bh-langchain-api-key`	`bh/langchainapikey`	`bh/langchainapikey`
`keycloak.grantType`	`bh-keycloak-grant-type`	`bh/keycloakgranttype`	`bh/keycloakgranttype`
`keycloak.adminPassword`	`bh-kcadminpwd`	`bh/kcadminpwd`	`bh/kcadminpwd`
`keycloak.dbPassword`	`bh-kcdbpwd`	`bh/kcdbpwd`	`bh/kcdbpwd`
`keycloak.tempTenantPassword`	`bh-temp-tenant-user-password`	`bh/temptenantuserpwd`	`bh/temptenantuserpwd`
`app.awsAccessKey`	`AWS_ACCESS_KEY`	`AWS_ACCESS_KEY`	`AWS_ACCESS_KEY`
`app.awsSecretAccessKey`	`AWS_SECRET_ACCESS_KEY`	`AWS_SECRET_ACCESS_KEY`	`AWS_SECRET_ACCESS_KEY`
`tls.cert`	`<env>-aws-bighammer-tls-crt`	`wildcard-prod-bighammer-crt`	`wildcard-dev-bighammer-crt`
`tls.key`	`<env>-aws-bighammer-tls-key`	`wildcard-prod-bighammer-key`	`wildcard-dev-bighammer-key`

Copy values-release.yaml → values-<env>.yaml and set remoteSecrets to the exact names you create in Secrets Manager.

Example overlay fragment:

global:
  remoteSecrets:
    postgres:
      password: bh-dev-user-password
      clientCert: bh-rdsssl
    rabbitmq:
      password: bh-rabbitmq-password
    catalog:
      decryptionKey: bh-catalog-decryption-key
      license: license-catalog
      licensePubKey: license-catalog-pub-key
    audit:
      oauthToken: bh-oauth-token
    aiagent:
      redisPassword: bh-redis-password
      langchainApiKey: bh-langchain-api-key
    keycloak:
      grantType: bh-keycloak-grant-type
      adminPassword: bh-kcadminpwd
      dbPassword: bh-kcdbpwd
      tempTenantPassword: bh-temp-tenant-user-password
    app:
      userPassword: bh-app-user-password
      awsAccessKey: AWS_ACCESS_KEY
      awsSecretAccessKey: AWS_SECRET_ACCESS_KEY
    tls:
      cert: myenv-aws-bighammer-tls-crt
      key: myenv-aws-bighammer-tls-key

Application database dual-role

Env var	DB role	Secrets Manager secret	Used for
`POSTGRES_USER` + `POSTGRES_PASSWORD`	`bh_dev_user`	`bh-dev-user-password`	Alembic / migrations — DDL
`BH_APP_USER` + `BH_APP_USER_PASSWORD`	`bh_app_user`	`bh-app-user-password`	Runtime SQLAlchemy — DML

Mismatch between Secrets Manager values and PostgreSQL role passwords is the most common cause of password authentication failed.

Keycloak server database

Resource	Name	Chart mapping
Database	`keycloak_db_<env>`	`global.bhkeycloak.env.KC_DB_URL`
User	`keycloak_db_user`	`global.bhkeycloak.env.KC_DB_USERNAME`
Password	`bh-kcdbpwd`	`global.remoteSecrets.keycloak.dbPassword`

bhkeycloakapi uses the application database (schema keycloakapi_db), not the Keycloak server database.

Which services pull which secrets

Service	Secrets pulled (via ExternalSecret)
`bhcatalogapi`	Postgres, SSL cert, decryption, RabbitMQ, license, pub key, app user, AWS keys
`bhcatalogworker`	Postgres, SSL cert, decryption, RabbitMQ, app user, AWS keys
`bhauditapi` / `bhauditworker`	Postgres, SSL cert, OAuth token, RabbitMQ, app user, AWS keys
`bhaiagent` / `bhaiagentworker`	Postgres, SSL cert, LangChain, Redis, decryption, RabbitMQ, app user, AWS keys
`bhmigrateapi` / `bhmigrateworker`	Postgres, Redis, decryption, RabbitMQ, app user, AWS keys
`bhcelerybeat`	Postgres, SSL cert, decryption, RabbitMQ, app user, AWS keys
`bhkeycloak`	Postgres password, Keycloak admin, Keycloak DB password
`bhkeycloakapi`	Grant type, admin pwd, decryption, Postgres, SSL, temp tenant, app user, AWS keys
`bhui`	Decryption key, `tls.crt`, `tls.key`
`bhadminui`	Decryption key
`bhtransformationutils`	AWS access key id + secret

Create secrets (CLI examples)

Plaintext string secrets (typical):

REGION=us-east-1

aws secretsmanager create-secret --region "$REGION" \
  --name bh-dev-user-password \
  --secret-string '<password>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-app-user-password \
  --secret-string '<password>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-kcdbpwd \
  --secret-string '<password>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-kcadminpwd \
  --secret-string '<password>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-keycloak-grant-type \
  --secret-string 'password'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-temp-tenant-user-password \
  --secret-string '<password>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-rabbitmq-password \
  --secret-string '<same-as-bhrabbitmq-chart>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-redis-password \
  --secret-string '<password>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-langchain-api-key \
  --secret-string '<api-key>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-catalog-decryption-key \
  --secret-string '<key>'

aws secretsmanager create-secret --region "$REGION" \
  --name license-catalog \
  --secret-string '<license-string>'

aws secretsmanager create-secret --region "$REGION" \
  --name license-catalog-pub-key \
  --secret-string '<public-key-pem-or-material>'

aws secretsmanager create-secret --region "$REGION" \
  --name bh-oauth-token \
  --secret-string '<token>'

aws secretsmanager create-secret --region "$REGION" \
  --name AWS_ACCESS_KEY \
  --secret-string '<AKIA…>'

aws secretsmanager create-secret --region "$REGION" \
  --name AWS_SECRET_ACCESS_KEY \
  --secret-string '<secret>'

# TLS PEMs (raw file contents)
aws secretsmanager create-secret --region "$REGION" \
  --name myenv-aws-bighammer-tls-crt \
  --secret-string file://tls.crt

aws secretsmanager create-secret --region "$REGION" \
  --name myenv-aws-bighammer-tls-key \
  --secret-string file://tls.key

Use put-secret-value to update an existing secret.

Verify after create

kubectl -n bh-control-plane get externalsecret
kubectl -n bh-control-plane describe externalsecret bhcatalogapi
# Ready=True, Reason=SecretSynced

kubectl -n bh-control-plane get secret bhcatalogapi

Force a refresh after adding a missing SM secret:

kubectl -n bh-control-plane annotate externalsecret bhcatalogapi \
  force-sync="$(date +%s)" --overwrite

Azure / GCP parity

Cloud	Secrets store	Doc
AWS	Secrets Manager	This page
Azure	Key Vault	Key Vault Secrets
GCP	Secret Manager	Secret Manager Secrets

Naming differs per cloud; the logical set (DB dual-role, Keycloak, RabbitMQ, Redis, licenses, OAuth, TLS) is the same.

Flow​

Initial secrets checklist (create these first)​

A. Platform / database (required)​

B. One-time application secrets (required)​

C. AWS credentials injected into pods (required by current images)​

D. TLS PEMs for Ingress (when ingress.tlsEnabled: true)​

E. Optional​

Chart defaults vs sample overlays​

Application database dual-role​

Keycloak server database​

Which services pull which secrets​

Create secrets (CLI examples)​

Verify after create​

Azure / GCP parity​