Secrets and trust
Treat credentials, licensing material, and private keys as sensitive deployment inputs. Keep them out of source control, rendered artifacts, command-line arguments, and build logs.
Sensitive material
| Material | Handling boundary |
|---|---|
| Registry pull token | Create the namespace-local graph-artifacts Kubernetes Secret through the approved secret-management process. |
| Graph Studio credentials | Restrict access to generated or pre-created Kubernetes Secrets. |
| Keycloak client secret | Supply it only at deployment time and limit access to the custom resource or rendered artifact that contains it. |
| License and server ID | Treat both as installation-scoped licensing material; retain the same server ID for the life of the installation. |
| TLS private key and keystore password | Store them only in the approved certificate/secret-management path. |
| Trusted CA certificates | Manage them as the approved CA bundle used to validate external services. |
Secret-handling rules
- Use the organization's approved secret manager or Kubernetes-secret provisioning process.
- Do not commit plaintext values, rendered custom resources, Helm values files, or automation logs that contain sensitive material.
- Do not pass a raw secret as a command-line argument.
- Limit Kubernetes RBAC read access to Secrets, Graph Studio custom resources, and Helm release Secrets.
- Assign an owner and rotation process for every credential, token, client secret, and certificate.
For secure noninteractive provisioning and rendering mechanics, see Template and secret contract.
Server identity and outbound trust
A server certificate and a trust bundle solve different problems:
- Server identity: the certificate and private key Graph Studio presents to browsers and other clients.
- Outbound trust: the CA certificates Graph Studio uses when validating services it connects to, such as Keycloak or LDAP.
Use a supported server-certificate configuration and configure a trustBundle when Graph Studio must trust a private or internal CA. Do not disable certificate validation to work around a missing or outdated CA bundle.
See Manage certificates and trusted CAs for the supported Graph Studio operator configuration.
Licensing material
Graph Studio licensing uses licenseEncoded and a stable serverId in initialization configuration. Neither value should be committed or regenerated during a restart, upgrade, or redeployment of the same installation.
See Graph Studio licensing for the supported licensing configuration and handling constraints.