Skip to content

openshift/secrets/uri-prefix

URI prefix for per-cluster secret references in the external secret store

Everything in a secret reference URI that comes before the per-secret leaf name: scheme, host, and the query up to and including the per-cluster path/name separator. The openshift-secrets profile composes each secure param's LookupUri as this prefix plus the leaf name (kubeconfig, ssh-key, ...), plus &format=json for structured params.

Requirements

There is intentionally no default: the value only exists when a backend profile (or an operator override) provides it. openshift/secrets/store and openshift/cluster-domain must be set for the supplied grammars to resolve.

Usage

Operators normally never set this param: each backend profile in this bundle supplies the grammar its backend requires, keyed on openshift/secrets/store and the cluster FQDN (<name>.<cluster-domain>). The authoritative grammar for each backend lives in (and is documented by) its profile: see openshift-secrets-vault, openshift-secrets-awssecman, or openshift-secrets-azkeyvault.

Set it yourself to relocate per-cluster secrets or to target a secret-store backend this bundle does not ship a profile for. Set the override on the cluster itself (cluster-level params outrank profile-supplied values). A profile-hosted override only wins if that profile is ordered before the backend profile in the cluster's profile list, and global never wins: global is the lowest-precedence source in aggregation. The value may contain template expressions; they are expanded per cluster at read and write time, anywhere in the string, scheme included.

Objects that Reference openshift/secrets/uri-prefix

Objects used by openshift/secrets/uri-prefix

Not used in current content packs