Secrets and Vaults

Local vault:

cnos vault create default
cnos vault auth default
cnos secret set app.token --vault default

cnos vault create default initializes the local encrypted vault immediately. If CNOS cannot resolve a passphrase from env or keychain, it prompts interactively. cnos vault auth default is only for re-authenticating an existing vault and rejects wrong passphrases.

For local vaults, when [value] is omitted, cnos secret set prompts for a masked secret value so it does not have to appear in shell history. For non-interactive pipelines, use --stdin instead:

printf "super-secret" | cnos secret set app.token --vault default --stdin

Environment-backed vault:

cnos vault create firebase-prod --provider environment --no-passphrase
cnos secret set app.token APP_TOKEN --vault github-ci
cnos secret set app.token --vault firebase-prod

environment is the generic provider for platforms that inject secrets into environment variables before your process starts. github-secrets remains a compatibility alias for the same behavior.

For non-local vaults such as environment, gcp-secret-manager, aws-secrets-manager, hashicorp-vault, and azure-key-vault, cnos secret set writes reference metadata only. CNOS does not prompt for or store secret material in the repo. If [value] is omitted, CNOS uses the logical secret path as the external ref; create or update the actual secret in the backing vault separately.

This is the CNOS bridge for common cloud and CI runtimes:

GitHub Actions secrets
Firebase Functions / Google Secret Manager bindings
Cloud Run env-injected secrets
Kubernetes Secrets exposed as env vars
Vercel project secrets
Netlify environment variables
AWS Lambda environment variables
Azure App Service environment variables

By default:

repo files store only refs
local secret material stays outside the repo
reads are masked unless --reveal is explicitly requested

Remote provider packages are compiled into the runtime and selected through vaults.<name>.provider in the manifest. CNOS does not dynamically load provider packages from config.

vaults:
  prod-gcp:
    provider: gcp-secret-manager
    auth:
      method: iam
      config:
        projectId: acme-prod
    fallback:
      - provider: environment
        mapping:
          DB_PASSWORD: db.password

See Vault Providers for the provider package contract, conformance testkit, and security rules.