Skip to main content

​
Overview

Key Manager supports multiple simultaneous secret store backends. Different stores can be assigned to different projects, providing tiered security levels — e.g., routing regulated projects to HSM-backed storage while using software crypto for development projects.
Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

​
List Secret Stores

List all configured secret stores
Show the platform-default secret store

​
Assign a Store to a Project

Assign a specific secret store to a project to override the platform default:
Set preferred store for a project
Show the preferred store for a project
Reset to platform default
Changing a project’s preferred store does not migrate existing secrets. Secrets created before the change remain in the original store. Only new secrets use the newly assigned store.

​
Multi-Store Design Patterns

​
Migration Between Stores

Migrating existing secrets from one store to another is a manual process:
1

Retrieve existing secrets

Export all secret payloads from the current store. This requires read access to every secret in the project.
2

Assign the new store to the project

Set new preferred store
3

Re-create secrets in the new store

Store each payload as a new secret. The new secrets will be encrypted by the new store.
4

Update all references

Update any services, Load Balancer listeners, or containers that reference the old secret HREFs to point to the new secret HREFs.
5

Delete old secrets

Once all references are updated and verified, delete the original secrets from the old store.

​
Next Steps

Backend Configuration

Configure the underlying backend for each secret store

Transport Keys

Manage RSA transport keys for client-side encryption

Security

Apply hardening policies for each store type

Quotas

Set per-project limits for secret creation