Manage secret backends

Add a secret backend

To add a secret backend to the controller, in your Terraform plan create a resource of the juju_secret_backend type, specifying a name, the backend type, and the backend configuration. For example, to add a Vault backend:

resource "juju_secret_backend" "myvault" {
  name         = "myvault"
  backend_type = "vault"
  config_wo = {
    endpoint = "https://vault.example.com:8200"
    token    = "s.exampletoken"
  }
  config_wo_version = 1
}

Note

The config_wo attribute is write-only — its content is never stored in Terraform state. To update the configuration, change the config_wo values and bump config_wo_version.

Set the secret backend for a model

Secret backends are per model. The recommended way to set which backend a model uses is the secret_backend attribute on the model resource:

resource "juju_model" "development" {
  name           = "development"
  secret_backend = juju_secret_backend.myvault.name
}

Note

On Juju 4+, this uses the dedicated model-secret-backend API. On Juju 3, it falls back to setting the secret-backend model config key. When using this attribute, the secret-backend key is stripped from the model’s config attribute to avoid state drift.

For backward compatibility, you can also set the secret-backend key directly in the model’s config block. This works on Juju 3 but is not recommended on Juju 4, where the secret_backend attribute should be used instead:

resource "juju_model" "development" {
  name = "development"
  config = {
    secret-backend = juju_secret_backend.myvault.name
  }
}

Important

Changing the secret backend for a model triggers an asynchronous migration of existing secrets to the new backend. This applies in both directions — from one external backend (e.g. Vault) to another, and from the default internal backend to an external backend.

Because the migration is asynchronous, the juju_model update returns before the secrets have finished moving. A juju_secret inspected immediately after the change may therefore still report the old backend.

Update a secret backend

To update a secret backend’s configuration, change the config_wo values and bump config_wo_version:

resource "juju_secret_backend" "myvault" {
  name         = "myvault"
  backend_type = "vault"
  config_wo = {
    endpoint = "https://vault.example.com:8200"
    token    = "s.newtoken"
  }
  config_wo_version = 2
}

Remove a secret backend

To remove a secret backend, remove its resource definition from your Terraform plan.