Secrets Manager Secrets Reference

Define AWS Secrets Manager secret names and map them in global.remoteSecrets before your first Helm deploy.

Secret names are not secret values

This page lists Secrets Manager secret names (chart defaults). These are configuration identifiers — not passwords or credentials. Store actual values only in Secrets Manager; never commit them to Git or Helm values files.

The chart maps AWS Secrets Manager secret names to Kubernetes secret keys via External Secrets. Defaults live in values.yaml; per-environment overrides go in values-<env>.yaml (see sample values-release.yaml in the chart — placeholder account IDs and hostnames only).

Flow

1. Platform prerequisites — DB passwords and optional SSL material exist in Secrets Manager (your provisioning tool, console, or automation).
2. One-time setup — ensure application secrets are created.
3. SecretStore (aws-secret-store) authenticates with IRSA.
4. ExternalSecret per service syncs into K8s Secrets.
5. Pods consume env vars or mounted files.

Platform prerequisites (verify only)

These must be provisioned before deploying Helm:

Secret Name	Required	Purpose
bh-dev-user-password	Yes	bh_dev_user (migrations / Alembic)
bh-app-user-password	Yes	bh_app_user (runtime DML)
db-postgres-password	Yes	postgres superuser (bootstrap SQL)
bh-kcdbpwd	Yes	keycloak_db_user (KC_DB_PASSWORD on bhkeycloak)
db-client-cert	No	RDS client certificate
db-server-ca-cert	No	RDS server CA
db-client-private-key	No	RDS client key (PEM)

One-time application secrets

Secret Name	Purpose
bh-kcadminpwd	Keycloak admin UI password
bh-keycloak-grant-type	Grant type (default: password)
bh-catalog-decryption-key	Catalog decryption key
bh-temp-tenant-user-password	Temporary tenant password
bh-rabbitmq-password	RabbitMQ password
bh-redis-password	Redis password
bh-langchain-api-key	LangChain API key
bh-oauth-token	OAuth token (audit API)
license-catalog	Catalog license string
license-catalog-pub-key	Catalog license public key

Application database dual-role

Services on the application database use two PostgreSQL roles, matching bighammer_db_setup.sql:

Env var	DB role	Secrets Manager Secret	Used for
POSTGRES_USER + POSTGRES_PASSWORD	bh_dev_user	bh-dev-user-password	Alembic / migrations — DDL
BH_APP_USER + BH_APP_USER_PASSWORD	bh_app_user	bh-app-user-password	Runtime SQLAlchemy — DML only

Align values and Secrets Manager

global:
  remoteSecrets:
    postgres:
      password: bh-dev-user-password   # POSTGRES_PASSWORD → bh_dev_user
    app:
      userPassword: bh-app-user-password    # BH_APP_USER_PASSWORD → bh_app_user

Each service that runs migrations and serves traffic needs both env var pairs in its env: block:

  bhcatalogapi:
    env:
      POSTGRES_USER: bh_dev_user
      BH_APP_USER: bh_app_user
      POSTGRES_DB: <your_app_database>
      DB_SCHEMA: catalog_db