Secret Containers

Overview

Containers group related secrets into a named bundle. The most common use case is bundling a TLS certificate with its private key for use with the Load Balancer service. Containers reference secrets by UUID — they do not copy secret payloads. Like secrets, containers are project-scoped — they are visible only to users within the project that created them unless shared via ACL.

Prerequisites

An active Polystack account with appropriate permissions
Access to the Polystack Dashboard or CLI configured with credentials
API credentials sourced (source openrc.sh)

Project Scope — Containers belong to the project that created them. The Load Balancer service accesses containers through the project’s service credentials. If you create a container in Project A and configure a listener in Project B, the listener cannot access the container unless an ACL is set.

Container Types

Container Type	Contents	Primary Use Case
certificate	Certificate + private key + intermediates + passphrase	TLS termination for Load Balancer HTTPS listeners
rsa	Public key + private key + passphrase	RSA key pair management
generic	Any combination of secrets	API credential bundles, configuration groups

Create a Certificate Container

The Dashboard provides a dedicated Create Certificate workflow that creates both the secrets and the container in a single step. This is the recommended approach for TLS certificate management.

Dashboard
CLI

Navigate to Certificate Manager

Navigate to Network > Certificates in the sidebar.Click Create Certificate in the upper-right corner.

Enter the certificate name

Enter a Certificate Name for the container. This name identifies the certificate bundle in the Load Balancer listener configuration.

The name must contain only letters, numbers, and hyphens. Special characters and spaces are not permitted.

Select the certificate type

Choose the Certificate Type:

Type	Description	Required Fields
Server	A server certificate with its private key for TLS termination	Certificate Content, Private Key
CA	A Certificate Authority certificate for client certificate validation	Certificate Content only

Use Server for HTTPS listener termination — this is the most common use case. Use CA when you need to validate client certificates in mutual TLS (mTLS) configurations.

Provide the certificate content

Paste the certificate content into the Certificate Content text area, or click the upload button to load it from a .crt or .pem file.The certificate must be in PEM format:

Expected format

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhki...
-----END CERTIFICATE-----

The form validates that the content starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----. Certificates in other formats (DER, PKCS#7) must be converted to PEM first.

Provide the private key (Server type only)

For Server type certificates, paste the private key into the Private Key text area, or upload a .key or .pem file.The key must be in PEM format:

Expected format

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA2a2rwplBQLYV0...
-----END RSA PRIVATE KEY-----

This field is hidden for CA type certificates. The private key must be in RSA format — ECDSA and Ed25519 keys must be converted first.

Add domain names (optional, Server type only)

For SNI (Server Name Indication) certificates, enter the Domain Name(s) that this certificate covers.

Rule	Limit
Multiple domains	Separated by commas
Maximum domains	30 per certificate
Single domain length	100 characters max
Total length	1024 characters max
Valid characters	Letters, numbers, hyphens, dots

Domain names are used for SNI-based certificate selection in the Load Balancer. If your listener serves multiple domains, specify all of them here so the correct certificate is presented for each domain.

Set an expiration date (optional)

Use the Expires At date picker to set an optional expiration date. Only future dates are selectable.

This is the container-level expiration, independent of the certificate’s own validity period. Set it to match your certificate’s actual expiry date for consistency.

Create the certificate

Click Confirm to create the certificate container. The system stores the certificate and private key as separate secrets and bundles them into a container automatically.

The certificate container appears in the Certificates list and is ready to reference in Load Balancer HTTPS listener configuration.

With the CLI, you create the individual secrets first, then bundle them into a container. Source your project credentials first:

Source credentials

source openrc.sh

Store the certificate secret

Store TLS certificate

CERT_HREF=$(openstack secret store \
  --name app-tls-cert \
  --secret-type certificate \
  --payload-content-type "application/pkix-cert" \
  --payload-content-encoding base64 \
  --payload "$(base64 -w 0 certificate.pem)" \
  -f value -c Secret\ href)

Store the private key secret

Store private key

KEY_HREF=$(openstack secret store \
  --name app-tls-key \
  --secret-type private \
  --payload-content-type "application/pkcs8" \
  --payload-content-encoding base64 \
  --payload "$(base64 -w 0 private_key.pem)" \
  -f value -c Secret\ href)

Store the CA chain (recommended)

Store CA chain

CA_HREF=$(openstack secret store \
  --name app-ca-chain \
  --secret-type certificate \
  --payload-content-type "application/pkix-cert" \
  --payload-content-encoding base64 \
  --payload "$(base64 -w 0 ca-chain.pem)" \
  -f value -c Secret\ href)

Create the certificate container

Bundle into certificate container

openstack secret container create \
  --name app-tls-bundle \
  --type certificate \
  --secret "certificate=$CERT_HREF" \
  --secret "private_key=$KEY_HREF" \
  --secret "intermediates=$CA_HREF"

Container is ready to reference in Load Balancer HTTPS listener configuration.

Create an RSA container

RSA key pair container

openstack secret container create \
  --name app-signing-keypair \
  --type rsa \
  --secret "public_key=$PUB_HREF" \
  --secret "private_key=$KEY_HREF" \
  --secret "private_key_passphrase=$PASS_HREF"

Create a generic container

Generic container for grouped credentials

openstack secret container create \
  --name app-credentials \
  --type generic \
  --secret "db_password=$DB_HREF" \
  --secret "api_key=$API_HREF" \
  --secret "encryption_key=$ENC_HREF"

View Container Details

Dashboard
CLI

Navigate to containers

Go to Project > Key Manager > Containers. The list shows all containers in your current project.

Column	Description
Name	Container identifier (clickable to view details)
Type	Container type: certificate, rsa, or generic
Status	Active or Error
Secrets	Number of secret references in the container
Created	Creation timestamp

View detail page

Click a container name to view its detail page. The detail page shows:

Field	Description
Type	Container type
Status	Current status
Secret References	List of name and secret reference pairs
Created	Creation timestamp
Updated	Last modification timestamp

openstack secret container list

openstack secret container show <container-href>

Delete a Container

Dashboard
CLI

Select containers to delete

Navigate to Project > Key Manager > Containers. Select one or more containers using the checkboxes, then click Delete in the batch actions bar.Alternatively, click the More menu on a single container row and select Delete Container.

Confirm deletion

Confirm the deletion in the dialog.

Deleting a container through the Dashboard also deletes all associated secrets within it. Verify that no services reference these secrets before proceeding.

Delete a container

openstack secret container delete <container-href>

Deleting a container via the CLI does not delete the secrets it references. The secrets remain in Key Manager and must be deleted separately if no longer needed.

Project Scope and Access

Containers follow the same project-scoping rules as secrets:

Behavior	Description
Ownership	Containers belong to the project that created them
Visibility	Only visible to users within the same project
Service access	The Load Balancer accesses containers through the project’s service credentials
Cross-project sharing	Requires an ACL on the container
Contained secrets	Secrets within the container must also be accessible to the consuming service

When sharing a container via ACL, you must also set ACLs on each secret referenced by the container. Granting access to the container alone does not grant access to the secret payloads within it.

Next Steps

Certificates

Manage the full certificate lifecycle from storage to renewal

Access Control (ACL)

Share containers and secrets across projects

Store Secrets

Create individual secrets to populate containers

Load Balancer

Use certificate containers for HTTPS listener configuration

Core Services

Other Services

Overview

Container Types

Create a Certificate Container

Navigate to Certificate Manager

Enter the certificate name

Select the certificate type

Provide the certificate content

Provide the private key (Server type only)

Add domain names (optional, Server type only)

Set an expiration date (optional)

Create the certificate

Store the certificate secret

Store the private key secret

Store the CA chain (recommended)

Create the certificate container

View Container Details

Navigate to containers

View detail page

Delete a Container

Select containers to delete

Confirm deletion

Project Scope and Access

Next Steps

Certificates

Access Control (ACL)

Store Secrets

Load Balancer

​Overview

​Container Types

​Create a Certificate Container

Navigate to Certificate Manager

Enter the certificate name

Select the certificate type

Provide the certificate content

Provide the private key (Server type only)

Add domain names (optional, Server type only)

Set an expiration date (optional)

Create the certificate

Store the certificate secret

Store the private key secret

Store the CA chain (recommended)

Create the certificate container

​View Container Details

Navigate to containers

View detail page

​Delete a Container

Select containers to delete

Confirm deletion

​Project Scope and Access

​Next Steps

Certificates

Access Control (ACL)

Store Secrets

Load Balancer

Overview

Container Types

Create a Certificate Container

View Container Details

Delete a Container

Project Scope and Access

Next Steps