🔐 Secrets in Routines

A secret, such as a Git token or an S3 key, is saved once in a project. Jobs refer to it by key; the value itself never appears in a job description, a jobflow, the job list or the pod running your code.

---

🗝️ Project secrets and personal secrets

	Project secret	Personal secret
Where	Project → Secrets → Project secrets	Project → Secrets → My secrets
Who adds, rotates, deletes	Project admins	Only you
Who can see the key name	Admins and developers	Only you
Used by	Every admin's and developer's jobs	Only jobs you dispatch

If a personal secret and a project secret have the same key, your personal one is used for your jobs.

Nobody can read a value back after saving, admins included. Stakeholders (policy makers) can't see the Secrets page and can't dispatch jobs. When someone leaves the project, their personal secrets are deleted.

A key is written in capitals, digits and _, and doesn't start with a digit, for example GIT_PAT or DVC_S3_SECRET.

---

➕ Adding, rotating and deleting

1. Open your project and choose Secrets in the sidebar.
2. Pick Project secrets (admins) or My secrets, then Add.
3. Enter the key, the value and an optional description, and save.

Rotate replaces the value; jobs dispatched or restarted afterwards use the new one. Delete is refused while a job that hasn't finished yet references the key.

---

🧩 Using secrets in a job

job_secrets maps the env var name your code reads to the secret key:

task = WKubeTask(
    ...
    job_secrets={
        "GIT_PAT": "GIT_PAT",                      # env var GIT_PAT ← secret GIT_PAT
        "AWS_SECRET_ACCESS_KEY": "DVC_S3_SECRET",  # names can differ
    },
)

Inside the job these are ordinary environment variables, so existing code keeps working.

Never put a value in job_secrets

Every value is looked up as a key. A pasted token is not a key, so the dispatch is rejected with an error naming the env var, and the token is never stored.

In the web app, the run form shows one dropdown per secret the routine asks for (its secrets schema) and pre-selects the key with the same name. If a required key is missing, use the Missing — add in Secrets link.

Files instead of env vars

Environment variables can leak through env dumps, set -x, crash reports and child processes. To get a secret as a file instead, use job_secret_files:

task = WKubeTask(
    ...
    job_secret_files={"git_pat": "GIT_PAT"},
)

The value is mounted read-only at /var/run/secrets/wkube/git_pat. File names use letters, digits and _, and don't start with a digit.

Restarts

A restart looks every key up again, so rotating a secret fixes a job that failed because of an expired token, without editing the job. A restarted job uses the secrets of the user who first dispatched it.

So that nobody else's run can use your personal secrets, only you can restart or edit a job that uses them, including a job whose children or callbacks use them. Anyone else gets an error and can dispatch their own job instead. Jobs that use only project secrets can be restarted by any admin or developer.

---

🧷 Reserved keys

The platform reads these env var names when a job provides them:

Env var	Used for
ACC_WKUBE_GIT_USER, ACC_WKUBE_GIT_PASSWORD	Cloning a private repo_url when building the job image
ACC_WKUBE_REGISTRY_SERVER, ACC_WKUBE_REGISTRY_USERNAME, ACC_WKUBE_REGISTRY_PASSWORD, ACC_WKUBE_REGISTRY_EMAIL	Pulling a private docker_image, or a private base image in a Dockerfile's FROM line, from one registry of your own

Map them like any other secret, for example job_secrets={"ACC_WKUBE_GIT_PASSWORD": "GITHUB_TOKEN"}.

ACC_WKUBE_REGISTRY_SERVER must match the registry host in the image name, for example ghcr.io for ghcr.io/myorg/base:1.0. A token with read access is enough. Images in the platform registry need no credentials.

---

🙈 Values in job logs

Before job output is stored, the platform replaces every secret value the job received with ***, including their base64 and URL-encoded forms. Values shorter than 4 characters are not masked.

Masking is a safety net, not a guarantee: code can still transform a value (split, reverse, encrypt) and print it. Don't print secrets.

---

✅ Good practice

• Prefer fine-grained, expiring tokens, for example a GitHub PAT limited to one repository, so a leaked value can do little and stops working on its own.
• Use personal secrets for credentials that belong to you, and project secrets for shared service accounts.
• Rotate a secret as soon as you suspect it leaked.