Skip to main content
  • Kind: Dependency
  • Version: 1
  • Fleet Manager owner: Fleet Manager squad, #fleet-manager-chat (individual claimant pending)
  • Counterpart owner: unassigned, SRE (secrets platform)
  • Last reviewed: 2026-09-09

​
What flows

Fleet Manager reads runtime secrets from 1Password at startup and on cache refresh (ADR-0008, src/fleet_manager/core/clients/one_password/). Vaults are scoped per deployment and environment: Fleet Manager {deployment} {env} for runtime secrets and Fleet Manager {deployment}-operators {env} for operator-managed credentials such as BMC and IPMI logins. Items read today include the NetBox API token, the OpenStack application credentials (openstack-undercloud, openstack-overcloud, openstack-slurm), mimir-login, the SLURM JWT, object-storage, azure-kusto and azure-kusto-admin, the LLM API key, and the hub root CA that signs the private-key JWT client certificates. Fleet Manager also writes: enrolment creates the per-device BMC credential items in the operators vault (src/fleet_manager/core/domain/bmc_provisioning.py), and the site-standup CLI seeds a new site’s items (see hashicorp-vault). Reads go through a 300 s TTL cache (OnePasswordCacheStore), and a dozen workflow activities (enrolment, connectivity verification, BMC cold reset, power cycle, image node, quarantine, node release, NVLink and NVSwitch credentials, maintenance, firmware inventory, Ironic clean) fetch BMC or service credentials at run time rather than at startup. NATS client certificates are the exception: they come from Vault through ExternalSecrets, not from 1Password. HashiCorp Vault is becoming the system of record with an SRE-owned sync copying secrets into 1Password; whether Fleet Manager should read Vault directly is an open decision recorded in ADR-0046’s context and pending an ADR-0008 update.

​
What breaks if this changes

A 1Password outage stops enrolment outright, because enrolment must create the device’s BMC credential item and cannot. It also fails any running workflow whose activity fetches a credential after the 300 s cache entry has expired: connectivity verification, re-enrolment, BMC cold reset, power cycle, image node, quarantine and release, NVLink and NVSwitch operations. A revoked service-account token or a renamed item has the same effect at the next fetch, and a wrong vault selector points a satellite at another site’s credentials. Because the root CA lives here too, an outage at rollout time blocks new client certificates even though running pods keep their cached secrets.

​
Enforcement

  • Principal: the per-environment 1Password service account each agent runs with.
  • Mechanism: 1Password service-account token injected by the charts; OP_VAULT_SELECTOR picks the deployment (src/fleet_manager/settings/base/logging.py, OnePasswordSettings).
  • Deployment guide: Site Dependencies and External Systems and PKI and Certificate Trust.

​
Gaps

  • The Vault-to-1Password sync is owned by SRE and not described in this repository; a sync failure surfaces as a stale secret with no Fleet Manager signal.
  • Direct Vault read is undecided.

​
Change log

  • 2026-09-09 v1: created; describes present behaviour.