Configure secret folders and global secrets so that you can reference them when you configure supported resources.

For the built-in cribl secret store, you can add secret folders and global secrets immediately. Cribl encrypts and stores secret values on the Leader. For secret stores that are backed by an external provider such as HashiCorp Vault, configure the secret store first. Then add secret folders and global secrets that reference secrets in the external provider.

Global secrets are supported only in Cribl.Cloud.

Add Secret Folders ​

The steps for adding a secret folder are the same whether the folder is backed by the built-in cribl secret store or an external provider secret store.

To add a secret folder:

1. In Global Settings > Security > Secret Folders, select Add Secret Folder.

2. In the New Secret Folder modal, enter the following information:

   • Secret store: The secret store to use for the folder.

   • Folder Name: Name for the folder. To help keep folders organized, name them after a team, environment, or data domain (for example, finance-prod or observability-shared).

   • Description: Optional description for the folder.

   • Accessible to: Select the Worker Groups and Edge Fleets to share the global secrets in the folder with.

     • All Worker Groups: Toggle on to share with all Worker Groups in the Workspace.

     • Worker Groups: Select specific Worker Groups to share with.

     • All Fleets: Toggle on to share with all Edge Fleets and Subfleets in the Workspace.

     • Fleets: Select specific Edge Fleets to share with. When you share a secret folder with an Edge Fleet, its Subfleets inherit access to the secrets in the folder.

3. Select Save.

Add Global Secrets ​

To add a global secret, you must have a secret folder to store it in. Sharing is controlled at the folder level, so confirm that the sharing settings for the folder are correct for the global secret before you add it.

Add Global Secrets in cribl-Backed Secret Folders ​

For cribl-backed secret folders, you enter all global secret values directly. Cribl encrypts and stores the values locally.

To add a global secret in a secret folder that is backed by the built-in cribl secret store:

1. In Global Settings > Security > Secret Folders, select the secret folder where you want to add the global secret.

2. Select Add Secret.

3. In the New Secret modal, add the following information:

   • Secret name: Name for the global secret.

   • Secret type: Select the type of the global secret and add values in the type-specific fields. Use latin1 encoding for global secret values.

     • Text: Enter the secret in the Secret value field.
     • API key and secret key: Enter key values in the API key and Secret key fields.
     • Username and password: Enter the username and password values in the Username and Password fields.

     You cannot change a global secret’s type after you create it. Instead, delete the global secret and create a new one with the desired type.

   • Description: Optional description for the global secret. The description helps Git reviewers identify the secret in the marker file.

   • Tags: Optional comma-separated list of labels for organizing and identifying the global secret.

4. Select Save.

Add Global Secrets in Externally Backed Secret Folders ​

For secret folders backed by external secret stores, provide the values for sensitive fields (text secrets, secret keys, and passwords) as references to secrets in the external provider. Enter non-sensitive fields like usernames and API keys directly as plaintext.

To add a global secret in a secret folder that is backed by an external secret store:

1. In Global Settings > Security > Secret Folders, select the secret folder where you want to add the global secret.

2. Select Add Secret.

3. In the New Secret modal, add the following information:

   • Secret name: Name for the global secret.

   • Secret type: Select the type of the global secret and add references in the type-specific fields.

     • Text: Enter the secret reference in the External secret reference field.
     • API key and secret key: Enter the API key in the API key field and the secret key reference in the Secret key reference field.
     • Username and password: Enter the username in the Username field and the password reference in the Password reference field.

     You cannot change a global secret’s type after you create it. Instead, delete the global secret and create a new one with the desired type.

   • Description: Optional description for the global secret. The description helps Git reviewers identify the secret in the marker file.

   • Tags: Optional comma-separated list of labels for organizing and identifying the global secret.

   • Response field: For JSON secret values, the top-level key to extract from the JSON in the external provider. Omit if the external provider returns the secret value as a plain string.

     • For example, if the secret is the apiKey value in a JSON object that is stored in the external provider at the path secret/finance/prod (where secret is the default KV v2 mount), enter finance/prod in External secret reference and apiKey in Response field.

4. Select Save. Cribl fetches the referenced value from the external provider, records a baseline fingerprint (contentSha), and updates Git diffs for the global secret metadata and the marker file for affected Worker Groups and Edge Fleets.

Cribl extracts the specified key’s value and supplies it to any resource that references the global secret.

Use Global Secrets ​

To use a global secret when configuring a supported resource:

1. In the configuration modal for the resource, select the Secret option for the field where you want to use the global secret. Supported fields depend on the resource. For example, some Sources and Destinations support using global secrets for Authentication > Authentication method.

2. Select the Select global secret option.

3. In the drop-down menu, select the global secret reference. Global secret references use the form <secretFolderId>/<globalSecretId>.

Saved resource configurations store only references to global secrets, not the secret values. Cribl does not embed a copy of the global secret in the resource object and does not show any sensitive global secret values in the UI or in API responses.

For global secrets in externally backed secret stores, the Leader fetches values when it starts and serves cached values afterward so that routine operation does not depend on external provider availability.

Packs and Global Secrets ​

Sources, Destinations, and Collectors inside a Pack can reference global secrets the same way as resources outside a Pack. Saved configurations store only the reference (secretFolderId/globalSecretId), not the secret value.

Before you install a Pack from the Dispensary or import a Pack whose Sources, Destinations, or Collectors use global secrets, add the referenced secret folders and global secrets on the Leader and share the folders with the target Worker Groups and Edge Fleets. Cribl does not create secret folders or global secrets during Pack install.

Deploy Global Secrets ​

Resource configurations on the Leader store references to global secrets, not credential values. Worker Groups and Edge Fleets receive the resolved values only after you commit and deploy configuration for each affected Group or Fleet.

Global Secrets in Deployment Bundles and Git ​

When you commit and deploy configuration with Git, Cribl excludes secret values from Git-tracked artifacts and injects them into each deployment bundle at deploy time. At deploy time, the Leader must resolve every global secret in a shared secret folder before it builds the bundle. Deploy is blocked if the Leader cannot resolve any of the global secrets, even when no resource configuration references an unresolvable secret.

If an externally backed secret store is unhealthy but the Leader already cached the referenced secrets in memory, deploy can proceed using the cached values. See Secret Store Health Check Failures.

Cribl writes global secrets into the deployment bundle’s secrets.yml file when the Leader deploys, alongside other encrypted legacy secret rows for the Worker Group or Edge Fleet. Each global secret row is keyed by the composite string secretFolderId/globalSecretId. Each legacy secret row is keyed by the secret’s id alone. All rows are encrypted with the same cribl.secret material, and nodes use the same mechanism to decrypt and resolve global secret rows as for legacy secret rows in the bundle’s secrets.yml file.

Global secret rows in the deployment bundle’s secrets.yml are not committed to Git. To review global secret changes in Git, use the marker file.

Delete Global Secrets, Secret Folders, and Secret Stores ​

Cribl enforces the following deletion dependencies for global secrets, secret folders, and secret stores:

• A global secret cannot be deleted while it is still referenced in a resource configuration.
• A secret folder cannot be deleted while it still contains global secrets.
• A secret store that is backed by an external provider cannot be deleted while it still contains one or more secret folders.
• The built-in cribl secret store cannot be deleted.

To delete a global secret using the UI:

1. Remove all references to the global secret from resource configurations.

2. In Global Settings > Security > Secret Folders, select the secret folder that contains the global secret.

3. Find the global secret that you want to delete. Select the check box next to the global secret and Delete Selected Secrets.

To delete a secret folder using the UI:

1. Delete all global secrets in the secret folder.

2. In Global Settings > Security > Secret Folders, find the secret folder that you want to delete.

3. Select the check box next to the secret folder and Delete Selected Secret Folders.

To delete a secret store that is backed by an external provider using the UI:

1. Delete all secret folders that are backed by the secret store.

2. In Global Settings > Security > Secret Stores, select the secret store that you want to delete.

3. Select the check box next to the store and Delete Selected Secret Stores.

You can also use the following endpoints in the Cribl API to delete global secrets, secret folders, and secret stores:

• DELETE /system/secret-folders/{folderId}/secrets/{id} to delete a global secret.
• DELETE /system/secret-folders/{id} to delete a secret folder.
• DELETE /system/secret-stores/{id} to delete a secret store that is backed by an external provider. The built-in cribl secret store cannot be deleted.

View Resources that Reference a Global Secret ​

Use the GET /system/secret-folders/{folderId}/secrets/{id}/refs endpoint in the Cribl API to get a list of the resources that reference a specific global secret. For each reference to the global secret, the response specifies the resource type and ID, Cribl product context, Worker Group or Edge Fleet ID, and the name of the field in the resource configuration that uses the reference.

Responses list only direct global secret field references: secretFolderId/globalSecretId stored in supported resource configuration fields. Responses do not include global secrets referenced through C.Secret() JavaScript expression fields.