ankra secrets
Manage the organisation’s secrets (secret slots). A secret holds one value in Ankra’s vault. Manifests, addon values and MCP server env reference it by its sentinel, ${SECRET_SLOT:<id>}, instead of carrying the value, so the value never lives in Git, in a stack definition or in a chat transcript. Ankra substitutes the value only when it seals the file with the organisation’s SOPS key for delivery: put the sentinel at a key that the manifest’s or addon’s encrypted_paths declares. Values only go in, never come out: list shows names, ids, who uses each secret and when it was last read, never a value. A value is read from stdin, a masked prompt or--from-file, or generated by Ankra with --generate; it is
never accepted as a command-line argument.
ankra secrets create
Create a secret and print its sentinel, ${SECRET_SLOT:<id>}, on stdout. Put the sentinel where the value belongs. The value comes from exactly one of:--generate ignores stdin:
pipe a value without --generate to store it.
A generated secret expires (after one day by default, --ttl up to a week)
unless a deployed resource references its sentinel, which keeps it for as
long as it is referenced. A secret with a supplied value does not expire
unless --ttl is given.
The sentinel alone goes to stdout, so it can be captured:
ankra secrets delete
Delete a secret and its stored value. This cannot be undone. A secret that deployed resources still reference is refused, and the resources are named: remove the sentinel from them (or remove the resources) first. There is no--force: the platform refuses to delete a referenced
secret, because the next delivery of those resources would fail.
ankra secrets list
List the organisation’s secrets, newest first: name, id, whether a person or Ankra supplied the value, the deployed resources that reference it, when the value was last read and when the secret expires. Values are never shown. -o json includes each secret’s sentinel and every reference.ankra secrets rotate
Rotate a secret’s value in place. The secret keeps its id, so its sentinel and every reference to it stay valid; the resources that reference it receive the new value when Ankra next delivers them. With--generate Ankra creates the new random value and nobody sees it.
Without it the new value comes from --from-file or stdin, as for ‘set’;
with it, stdin is ignored. The value is never accepted as a command-line
argument.
ankra secrets set
Replace a secret’s value in place with one you supply. The secret keeps its id, so its sentinel and every reference to it stay valid; the resources that reference it receive the new value when Ankra next delivers them. The value comes from--from-file (the file’s bytes, exactly as stored) or
stdin (without the one line ending the pipe adds; on a terminal, a masked
prompt that drops surrounding spaces). It is never accepted as a command-line argument. To have Ankra
generate the new value, use ‘ankra secrets rotate --generate’.