From e1c99737cf68fcccf39bee4e7d44c4c62a8d6a30 Mon Sep 17 00:00:00 2001 From: automation-bot Date: Sat, 19 Sep 2026 00:25:01 +0300 Subject: [PATCH] docs: secrets-and-pki.md - add missing NetBird row to consumer table Found while auditing secret-distribution.md: NetBird is one of the 6 real docker_secret_templates-consuming hosts (confirmed via Agent Configurations KB note and the live template list - config.yaml, Hawser's secret, shared registry-token), but was missing from this doc's consumer table entirely. --- docs/secrets-and-pki.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/secrets-and-pki.md b/docs/secrets-and-pki.md index c3bf010..6f04c36 100644 --- a/docs/secrets-and-pki.md +++ b/docs/secrets-and-pki.md @@ -68,6 +68,7 @@ Every Vault Agent reaches Vault through the internal app-to-app proxy zone descr | User-Facing Proxy | Server + client certs for the mTLS-enforced browser zone, plus a shared registry-token render and Hawser's application secret | | Internal DNS | Server cert for its own admin UI/API only | | Security Monitoring | Its manager and dashboard services' shared secrets (indexer, API, dashboard passwords), plus Hawser's application secret, plus a shared registry-token render | +| NetBird | Its entire server config rendered as one file, embedded secrets included — the same file-templating pattern used for Kestra's `application.yml` — plus Hawser's application secret, plus a shared registry-token render | None of these ever call the Vault API themselves — every one of them goes through the same local-render sequence: