Dynamic secrets
Updated
Available on Enterprise (cloud) and on self-hosted keys that carry
dynamic-secrets. Free, Team, and Business never see the type. Staff-issued
Enterprise keys already include every licence feature if none are selected.
Kryptic stores encrypted provider config and lease metadata. The process that
needs the credential (the local daemon, kryptic ci export, or the Kubernetes
operator) decrypts that config, talks to Postgres, MySQL, Cassandra, Oracle,
Redis, or AWS IAM, and uploads a minted envelope. The platform never opens an
admin password or a leased password.
After a downgrade, existing dynamic rows stay in the database and stay inert: no new leases, no provider envelopes handed out, bundles skip them. Unlinking or deleting the definition still works so you can clean up.
How a lease is minted
Generate lease in the dashboard needs the Kryptic daemon running and signed
in on the same machine. The browser probes 127.0.0.1:5278. If nothing answers,
the drawer stops. The daemon then mints that lease. Renew and Revoke in the
drawer use the same local daemon so DROP ROLE actually runs.
The daemon only accepts these loopback calls from the hosted dashboard and
from the self-hosted dashboard implied by the Daemon BFF URL it signed into,
so a standard install needs no configuration. If your dashboard lives on a
domain unrelated to the Daemon BFF, set KRYPTIC_DASHBOARD_ORIGINS on each
developer's daemon to the exact origin, for example
KRYPTIC_DASHBOARD_ORIGINS=https://kryptic-ui.corp.example.
Apps through the daemon request a lease and that same daemon mints it. No other machine in the org sees the work.
CI (kryptic ci export) mints on the runner. The export writes
KRYPTIC_DYNAMIC_LEASES. End the job with kryptic ci revoke (or
trap 'kryptic ci revoke' EXIT in shell) so the role is dropped when the
pipeline finishes. Developers do not need to be online.
Kubernetes: the operator mints into the target Secret on reconcile and
revokes when the KrypticSecret is deleted.
If the process is killed before revoke, Postgres VALID UNTIL and AWS STS
expiry still bound the credential. The next export, daemon fetch, or operator
reconcile by the same identity reaps leftover revokes. kryptic connector run
is optional and only does that reap.
Optional leftover reaper
kryptic connector run [--name vpc-east]
Uses the signed-in daemon session, or machine credentials against the Secrets
API (KRYPTIC_CLIENT_ID / KRYPTIC_CLIENT_SECRET). It does not mint other
people's leases.
What the app receives
Daemon and CI inject {KEY}_USERNAME and {KEY}_PASSWORD. STS also sets
{KEY}_SESSION_TOKEN (and {KEY}_ACCESS_KEY_ID when AWS returns one). An
optional URL template on the definition fills {KEY} itself as a DSN.
Templates
Shared on every provider: default TTL, max TTL (renew cannot pass it), username
template ({{randomUsername}}, {{unixTimestamp}}, {{identity.name}},
{{dynamicSecret.name}}, {{random N}}, plus truncate / replace /
uppercase / lowercase), and editable create / revoke / renew statements.
Connection probe is not a platform call. The control plane cannot open the admin envelope. Generate a lease from a machine that can reach the database.