Manage secrets

Keep DIAL's keys, passwords, and credentials out of plaintext values files and source control. This guide inventories the secrets DIAL needs, shows how to supply them through Kubernetes Secrets or a cloud secret manager via the Secrets Store CSI driver, and explains the one secret you must never rotate casually. It assumes a Helm deployment with kubectl and Helm access.

Prerequisites

• DIAL deployed with the dial umbrella chart
• For a cloud secret manager: the Secrets Store CSI driver and your provider's CSI provider installed in the cluster

The secrets DIAL needs

Secret	Used by	Notes
DIAL API key	DIAL Chat → DIAL Core	Authenticates Chat and clients to Core
Encryption secret and key	DIAL Core	AES-encrypts a prefix to blob storage; see the warning below
Cache password or IAM identity	DIAL Core	Credentials for the managed Redis-compatible cache
Identity provider client secret	DIAL Chat / Core	For example AUTH_COGNITO_SECRET, plus NEXTAUTH_SECRET for Chat sessions
Keycloak and Postgres credentials	Keycloak (if used)	Admin and database passwords

warning

The DIAL Core encryption secret and key are generated on first install if you do not set them. Changing them changes bucket addressing and can make existing resources inaccessible. These settings do not establish encryption of file contents. Set them explicitly, store them in a secret manager, and treat them as permanent. Rotating them is a data-migration project, not a config change.

Option A: Kubernetes Secrets

For each service, the chart can read sensitive values from an existing Kubernetes Secret rather than from the values file.

Supply the encryption secret by reference:

core:
  configuration:
    encryption:
      existingSecret: dial-core-encryption   # holds keys "secret" and "key"

Inject other credentials as environment variables from a Secret:

core:
  extraEnvVarsSecret: dial-core-secrets

Create the Secrets with kubectl create secret or your GitOps sealed-secrets workflow. This keeps plaintext out of the values file but leaves the secrets in the cluster's etcd store.

Option B: A cloud secret manager via the CSI driver

To keep secrets in a managed vault and mount them at runtime, use the Secrets Store CSI driver. DIAL mounts the secret as a file and points aidial.config.files at it. The pattern is identical across providers — only the SecretProviderClass differs.

• Azure Key Vault — a complete worked example exists: Use Azure Key Vault secrets in Helm values.
• AWS Secrets Manager — install the AWS provider for the CSI driver, grant access with IRSA, and define a SecretProviderClass of provider: aws. Mount it through core.extraVolumes and core.extraVolumeMounts, exactly as the Azure example does.
• Google Secret Manager — install the GCP provider for the CSI driver, grant access with Workload Identity, and define a SecretProviderClass of provider: gcp.

The DIAL-side wiring (mount path plus aidial.config.files) is the same in all three cases:

core:
  env:
    aidial.config.files: '["/mnt/secrets-store/aidial.config.json"]'
  extraVolumes:
    - name: secrets-store
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: dial-core-spc
  extraVolumeMounts:
    - name: secrets-store
      mountPath: /mnt/secrets-store
      readOnly: true

Coming soon

DIAL provides no automated secret-rotation workflow. Rotation today means updating the secret in your manager and redeploying, and the encryption secret must not be rotated at all after first install. A worked rotation runbook will be added here.

Result

DIAL reads every credential from a Kubernetes Secret or a cloud secret manager. No plaintext keys live in your values file, and the irreplaceable encryption secret is stored and documented as permanent.

Further reading

• Use Azure Key Vault secrets in Helm values — the full CSI example
• Encryption configuration — what the encryption secret and key do
• Back up and restore DIAL — the encryption secret is a backup target
• Harden DIAL for production — secrets are one layer of hardening