Secrets and Identities
llms.txt lists every page for an agent
Show the whole prompt
Read https://intentius.io/chant/lexicons/cpln/secrets/.
For each workload I name that reads a secret, add a `SecretAccess` for its identity and secret and reference the value with `secretRef()` and its field qualifier, as the page shows.
Run `npx chant build` and `npx chant lint src` until CPL001 and CPL012 are clean, and open a pull request. Put no secret value in source, and do not create secrets in Control Plane.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.Optional: hand this page to your coding agent
Read https://intentius.io/chant/lexicons/cpln/secrets/.For each workload I name that reads a secret, add a `SecretAccess` for its identity and secret and reference the value with `secretRef()` and its field qualifier, as the page shows.Run `npx chant build` and `npx chant lint src` until CPL001 and CPL012 are clean, and open a pull request. Put no secret value in source, and do not create secrets in Control Plane.Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.Reading a secret at runtime takes three steps. Missing any one fails silently at runtime: the API accepts the broken form, the workload starts, and the failure surfaces later as an application error. Control Plane’s own documentation calls a partial version of this its number one support issue.
- The workload has an identity (
spec.identityLink). - A policy grants that identity
revealon the secret, naming it as//gvc/GVC/identity/NAME. - The reference is field-qualified:
cpln://secret/NAME.payload, notcpln://secret/NAME.
SecretAccess owns steps 1 and 2; secretRef() owns step 3.
Field qualifiers by type
Section titled “Field qualifiers by type”| Type | Field |
|---|---|
opaque | .payload |
dictionary | .KEY — one env var per key, or volume-mount as a directory |
userpass | .username, .password |
tls | .cert, .key |
keypair | .publicKey, .privateKey |
aws | .accessKey, .secretKey, .roleArn |
gcp | unqualified — conventionally a volume-mounted JSON file |
Identities
Section titled “Identities”GVC-scoped and not shareable: declare one per GVC with the same spec. A workload has at most one. Assign one only when the workload needs secret access, credential-free cloud access, or private networking; an empty assignment complicates audit traces for no benefit.
Section titled “GVC-scoped and not shareable: declare one per GVC with the same spec. A workload has at most one. Assign one only when the workload needs secret access, credential-free cloud access, or private networking; an empty assignment complicates audit traces for no benefit.”Values in source
Section titled “Values in source”Never. CPL001 fires on recognisable credential shapes at author time, where the finding has a file and a line and the credential has not yet reached git history; CPL012 catches the rest from the model. Read the value from the environment at build time, or set it out of band with cpln secret edit and let chant manage only the secret’s existence and type.