Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt

Use this file to discover all available pages before exploring further.

Some applications require credentials you provide - API keys, database passwords, webhook tokens, and similar. During configuration, the setup interface tells you exactly what’s needed and how to create each secret.

​
The Key Principle

Your secrets never leave your infrastructure. You create them directly in your own cluster or cloud secret manager. The controller detects them automatically and shows their status in the setup interface. We never see or store your secret values.

​
How It Works

1

Review

The setup interface lists every secret the application needs.
2

Identify

For each secret, it shows:
  • What the secret is for (e.g., “GitHub Personal Access Token for CI”)
  • Whether it’s required or optional
  • The exact command to create it
3

Create

You create the secret in your infrastructure.
4

Confirm

The controller detects it and the status updates to a green checkmark.
5

Skip (optional)

Optional secrets can be skipped.

​
Secret Types

​
Required Secrets

These must be created before the deployment can proceed. The setup interface won’t advance until all required secrets are detected.

​
Optional Secrets

These enable additional functionality but aren’t required. You can skip them during setup and add them later if needed.

​
What About Our Secrets?

Some secrets are provided by us (for example, internal service credentials that the application needs). These are handled automatically during deployment - you don’t need to create or manage them.

​
Creating Secrets

The setup interface generates ready-to-run kubectl commands. For example:
kubectl create secret generic github-token \
  -n <namespace> \
  --from-literal=token=<your-token>
Copy the command, replace the placeholder with your actual value, and run it. The secret goes directly into your cluster.

​
Verifying Secrets

Confirm your secrets were created in the correct namespace:
kubectl get secrets -n <namespace>
The setup interface also shows a green checkmark next to each detected secret.

​
Rotating Secrets

kubectl delete secret <secret-name> -n <namespace>
kubectl create secret generic <secret-name> \
  -n <namespace> \
  --from-literal=key=<new-value>
The controller detects the updated value automatically. No restart is needed in most cases.

​
Adding Secrets Later

If you skipped optional secrets during setup, you can add them at any time using the same creation command shown above. The controller polls periodically and will detect the new secret within 30-60 seconds.

​
Common Issues

SymptomLikely CauseFix
Secret not detectedWrong namespaceVerify you used -n <namespace> matching the deployment namespace
Secret not detectedWrong nameCopy the exact command from the setup interface to avoid typos
Secret not detectedDetection delayWait 30-60 seconds and refresh the setup interface

​
Security Guarantees

  • Secret values are created in your infrastructure by you
  • They are transmitted over your network
  • We see only the existence of secrets (present or missing), never their values
  • The setup interface shows status indicators, not secret contents