[Question]: Secret handling during the bootstrapping phase

[alexohneander]

📝 Question

While secrets are briefly mentioned in the prerequisites, I couldn't find any reference to them during the bootstrapping process. When using a SecretStore (e.g., OpenBao), secrets still need to be provisioned for components like ArgoCD or Grafana. However, this step is no longer mentioned later in the tutorial.

💡 What Have You Tried?

The core problem is also described here: #301
I suggest updating the tutorial to include explicit instructions on how to configure and deploy these secrets during the bootstrapping phase.

📎 Additional Context / Logs

No response

✅ Checklist

• I have searched existing issues
• I have checked the documentation

[Matthiator]

Hey @alexohneander, thanks for flagging this! You're totally right — this is a gap in our docs.

Just to give you the full picture: on STACKIT SKE / T Cloud Public the generated Terraform layer doesn't actually seed everything for you. The OAuth2 secrets, for example, ship as an example file that you activate with a copy step and then terraform apply — the exact file and folder depend on the provider:

• STACKIT SKE (STACKIT Secrets Manager): in platform-configs/<cluster>/terraform/infrastructure, run cp secrets.tf-oauth2 oauth2-secrets.tf
• T Cloud Public (OpenBao): in platform-configs/<cluster>/terraform/openbao, run cp secrets.tf-example secrets.tf

The matching TF_VAR_* entries (TF_VAR_argo_oauth2_client_id/secret, TF_VAR_grafana_oauth2_client_id/secret, TF_VAR_oauth2_client_id/secret, TF_VAR_image_pull_secret, …) are already waiting for you in the set-env file — you just fill in the values, source it and terraform apply writes them into the backend. And if you need any other secrets, you can also just drop them into the vault directly (e.g. with the bao/Vault CLI) — you'd then add the matching ExternalSecret manifest to the Helm chart.

We'll definitely get the docs updated so this seeding step is spelled out properly. In the meantime, if you let us know a bit about your setup — STACKIT SKE, T Cloud Public, or your own cluster + backend (OpenBao, Bitwarden, …) — we're happy to hand you the exact paths, keys and commands right here.

Feel free to drop by our Slack channel too if you'd rather chat things through: https://kubernetes.slack.com/archives/C0B2X0DLPR6 — happy to help either way! 🙂

Does this help you move forward? If not, just share a few more details about your setup (as mentioned above) and we'll get you sorted.

[alexohneander]

Hey @Matthiator, I just wanted to point that out. Thanks to the issue mentioned #301, I was able to solve the problem for my setup (Own Cluster + OpenBao). But I'm sure I won't be the last person to search for it :)