Secret
Secret
Declares a managed secret.
Establishes a secure vault entry for sensitive material such as credentials, API keys, and configuration. The executor provisions the secret container (with automatic replication) in the tenant core project under a deterministic physical name, and the computer resolves which principals may access its payload.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a Secret so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant Secret. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent in the dependency graph. |
| spec | Spec | Desired secret configuration. The authoritative, user-authored specification for this secret. See Spec. |
Spec
User-authored secret configuration.
Declares who may access the secret's value. The secret payload itself is set out of band; this manifest governs the container and its access policy.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of the secret. Optional free text describing this secret's purpose. Documentation-only: not propagated onto the provisioned Secret Manager secret; retained as manifest metadata and context for operators and AI assistants. |
| permissions | AccessPermissions | Principals allowed to access the secret. Users, groups, or service accounts granted access to the secret's value. Resolved by the computer into computed.permissions (names mapped to Cloud Identity IDs); the resulting accessor IAM bindings are applied by the consuming DeploymentConfig/JobConfig executors when an application references the secret. See AccessPermissions. |
AccessPermissions
Core definition for assigning administrative and viewer privileges across the platform.
Used by the engine to compute the final IAM policies (google_folder_iam_binding, etc.), aggregating individual user and group definitions to role assignments.
| Property | Type | Description |
|---|---|---|
| administrators | DetailedAccessPermissions | Administrators. Users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control. See DetailedAccessPermissions. |
| contributors | DetailedAccessPermissions | Contributors. Users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access. See DetailedAccessPermissions. |
| viewers | DetailedAccessPermissions | Viewers. Users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access. See DetailedAccessPermissions. |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |