Managed Secrets & KMS
Store product credentials in AMS — Secrets Manager–shaped versions and stages — envelope-encrypted by fabric KMS CMKs. Operate from Cloud next to IAM: create, reveal, put, rotate, schedule deletion. Keys stay software-HSM wrapped and Raft-replicated so peers share one cluster KEK.
SSO, tunnels, WireGuard, Argo CD, and managed packs hold AMS names or ARNs — never plaintext in karanodaka. Fabric mgmt token is not a Cloud session.
Architecture
How AMS, KMS, and consumers fit together
Host seed optional → AMS envelope → CMK → software HSM / cluster KEK → Raft. Cloud admin UI and product controllers both talk to the daemon gRPC API.
AMS
Secrets Manager–shaped store — versions, stages, KV or string
KMS CMK
Symmetric AES envelope or asymmetric SIGN_VERIFY / ENCRYPT_DECRYPT
Software HSM
CMK material wrapped under cluster KEK — never plaintext in Raft
Raft peers
Wrapped keys and secret metadata replicate across the fabric
Consumers
SSO, tunnels, WireGuard, Argo CD, packs — refs only in git
- 1
Host seed (optional day-0)
Place Cloudflare / WireGuard / SSO files under /var/lib/aanjaleyad/secrets/ on one host. StartPlatform imports missing AMS entries — do not copy seeds to every peer.
- 2
Create secret → envelope encrypt
Cloud or ctl creates an AMS secret bound to an AES CMK (auto-mint or pick existing). Values are AES-GCM envelope ciphertext; stages use AMSCURRENT / AMSPENDING / AMSPREVIOUS.
- 3
CMK wrapped by cluster KEK
Software HSM wraps CMK material with DeriveClusterKEK(mgmt token). Any peer after RewrapClusterKeys can unwrap — fabric mgmt token is not a Cloud session.
- 4
Products hold refs, not plaintext
SSOProvider, tunnels, VPN profiles, and managed packs store AMS names or ARNs. Destroy paths clear AMS; karanodaka never commits client secrets.
Product ARNs
Minted via libraries only — aanjaleya:secretsmanager:::secret:… and aanjaleya:kms:::key:…. Private CA is the third always-on pillar; see Private CA.
# Secret ARN aanjaleya:secretsmanager:::secret:aanjaleya/services/sso/google aanjaleya:secretsmanager:::secret:wireguard-vpn-crest # KMS key ARN aanjaleya:kms:::key:key-a1b2c3d4e5f67890
Always-on core
Not an optional pack
Managed Secrets and KMS are platform core — locked on with Private CA, cert-manager, Flux, CapA, Cilium, ABS, Kamaji, Zot, and Cloud. They are not toggled like managedValkey or other optional packs.
APIs are AWS-shaped for operator familiarity (Secrets Manager stages, KMS key specs / usages, BYOK import). The control plane is the fabric daemon over gRPC — not a public multi-region SaaS endpoint.