Source credentials

Source credentials let the selected project worker list and download backup artifacts. The values remain in a Kubernetes Secret in your cluster.

Required keys

S3 credentials may also include AWS_SESSION_TOKEN when the supplied access key requires a session token. Ensure its lifetime covers the whole check; expired temporary credentials cause download failures.

Create and connect credentials

1. 1

   Create a restricted source account

   Grant only the listing and read access required for the backup paths. Do not give a validation worker write or delete permissions unless another independent workflow requires them.

2. 2

   Create the Kubernetes Secret

   Add the exact keys above to a Secret in the selected project worker's job namespace. Give the Secret a DNS-compatible name. Repeat it in each worker job namespace where a schedule may run.

3. 3

   Register secret metadata

   Open Secrets, choose the matching source type, and enter the Kubernetes Secret name. RestoreTrust stores this reference, not the values.

4. 4

   Select it on the source

   Create or edit the source and select the active secret metadata entry. Source and secret types must match.

Rotate credentials

Update the Kubernetes Secret through your cluster process, then run a manual check. Keep the old credential valid until all worker namespaces have the replacement and the check succeeds. If you change the Kubernetes Secret's object name, update or replace the metadata and source reference as well.

Never put credential values in source names, descriptions, file paths, probes, or logs.