rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Parameter Store to bootstrap resolver

Browse Source 
probod-bootstrap could only resolve aws:// Secrets Manager refs.
Add awsps:// for SSM Parameter Store (GetParameter with decryption)
and awssm:// as an explicit Secrets Manager prefix. Keep aws:// for
backward compatibility. Values are cached per run per backend.
Update Helm, .env.example, and probod-bootstrap changelog.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-29 11:41:18 +02:00
parent ba1c9fccfa
commit 5cff72ce5b
9 changed files with 255 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
.env.example
View File

@@ -31,14 +31,17 @@
# PROBOD_AUTH_COOKIE_SECRET=this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes
# PROBOD_AUTH_PASSWORD_PEPPER=this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes
#
# Optional: load secrets from AWS Secrets Manager by setting env vars to
# aws://<secret-id> (e.g. PROBOD_ENCRYPTION_KEY=aws://probo/sandbox/probod/encryption_key).
# The path after aws:// is the Secrets Manager secret name or ARN; the
# plaintext SecretString is used directly. Plain env values are also supported.
# Requires AWS credentials for Secrets Manager resolution (IAM role, AWS_ACCESS_KEY_ID,
# or AWS_PROFILE) and AWS_REGION. These use the standard AWS SDK default chain, not
# PROBOD_AWS_*.
# PROBOD_ENCRYPTION_KEY=aws://probo/sandbox/probod/encryption_key
# Optional: load secrets from AWS by setting env vars to awssm://, aws://, or awsps:// refs.
# awssm://<secret-id> or aws://<secret-id> — Secrets Manager
# (e.g. PROBOD_ENCRYPTION_KEY=awssm://probo/probod/encryption_key).
# The path after the prefix is the secret name or ARN; the plaintext SecretString is used directly.
# awsps://<parameter-name> — SSM Parameter Store (e.g. PROBOD_ENCRYPTION_KEY=awsps:///probo/probod/encryption_key).
# The path after awsps:// is the parameter name; String and SecureString values are supported.
# Plain env values are also supported. Requires AWS credentials (IAM role, AWS_ACCESS_KEY_ID,
# or AWS_PROFILE) and AWS_REGION via the standard AWS SDK default chain, not PROBOD_AWS_*.
# PROBOD_ENCRYPTION_KEY=aws://probo/probod/encryption_key
# PROBOD_ENCRYPTION_KEY=awssm://probo/probod/encryption_key
# PROBOD_ENCRYPTION_KEY=awsps:///probo/probod/encryption_key
# ── Cookie ────────────────────────────────────────────────────────────
# PROBOD_AUTH_COOKIE_DOMAIN=localhost