Skip to main content

Group secrets

FleetAMP group secrets hold passwords, tokens, and other sensitive values for one ownership group. Only an administrator or an assigned Group Owner can add, replace, or delete a key. Values are write-only in the console and encrypted at rest; the page lists only key names and update metadata.

Use a secret in Collector configuration​

Open Groups & Labels, choose a group, and select Secrets. Add a key such as otlp_token, then reference it with a quoted placeholder:

exporters:
  otlphttp/production:
    endpoint: https://otel.example.com
    headers:
      Authorization: "Bearer ${secret:otlp_token}"

FleetAMP validates that every referenced key exists without displaying its value. It resolves placeholders only when constructing the OpAMP delivery payload. Immutable configuration versions retain the placeholder.

If a key is missing, validation or deployment is blocked. FleetAMP does not send a partial configuration.

Exposure boundaries​

Secret values are not included in:

  • configuration versions or Blueprint previews;
  • approval diffs or audit-event details;
  • group drift views or user-facing effective configuration;
  • secret-management responses after saving.

The built-in store is an encrypted FleetAMP secret store, not an external Vault integration.