• Products
    • Deckhouse Platform

      Creating identical Kubernetes clusters and managing them
    • Virtualization Platform

      Managing virtual machines
    • Observability Platform

      Infrastructure-wide centralized observability
    • Stronghold

      Securely managing lifecycle of secrets
    • Delivery Kit

      Building and delivering containerized software
    • Commander

      Cluster control center
    • Prom++

      Open Source monitoring system
    • Code

      Continuous development and software lifecycle management
    • Development Portal

      Centralized development workflow management
  • Solutions
    • Technical Support
    • Security
    • Training & Consulting
    • Deckhouse vs KaaS
  • Success stories
  • Community
Documentation Contact us
En Ru
Stronghold
  • Learn more
  • Documentation
  • Getting started
  • Products
    • Deckhouse Platform

      Creating identical Kubernetes clusters and managing them
    • Virtualization Platform

      Managing virtual machines
    • Observability Platform

      Infrastructure-wide centralized observability
    • Stronghold

      Securely managing lifecycle of secrets
    • Delivery Kit

      Building and delivering containerized software
    • Commander

      Cluster control center
    • Prom++

      Open Source monitoring system
    • Code

      Continuous development and software lifecycle management
    • Deckhouse Development Portal

      Centralized development workflow management
  • Solutions
    • Technical Support
    • Security
    • Training & Consulting
    • Deckhouse vs KaaS
  • Success stories
  • Community
  1. Overview
  2. Usage
  3. Secrets engines
  • Overview
    • About
      • Purpose and features
      • Editions
      • Requirements
    • Concepts
      • Lease
      • Authentication
      • Seal/Unseal
      • Response wrapping
      • Policies
      • Policy examples
      • Password policy
      • Identity
      • Token
      • Glossary
    • Installation
      • Running on Linux OS EE
        • Bootstrap
        • Installation
        • Switching editions
          • Switching Stronghold from EE to CSE
        • Configuration
        • Reference topologies
        • Upgrade
        • Recover from lost quorum
        • Removing
      • Launch in DP
        • Release channels
        • Platform installation
          • Installation steps
            • Prepare the environment
            • Platform installation
            • Initial access configuration
        • Platform configuration
          • Node management
            • Node configuration
              • OS configuration
              • Containerd configuration
              • Node group configuration
            • Node groups
            • Adding a node
            • Advanced settings
          • Switching editions
            • Switching Stronghold to Stronghold EE
            • Switching Stronghold from EE to CSE
          • Control plane
            • Components
              • Description
              • Overview
              • Etcd operations
              • Scheduler
              • Audit
            • Master nodes
          • Network management
            • Incoming traffic management
            • Outgoing traffic management
            • Routing management
            • DNS management
            • NTP management
          • Monitoring
            • Node monitoring
          • Access control
            • Role model
            • User management
            • Projects
        • Recover from lost quorum
        • Platform update
          • Platform update
          • Manual update mode
        • Removing the platform
        • Stronghold configuration
    • Administration
      • Overview
      • Operations
        • Monitoring
        • Metrics catalog
        • Server logs
        • Troubleshooting
        • Production checklist
        • Key management
        • TLS certificates
        • Quotas
        • Sizing
        • FAQ
      • Audit EE
        • Overview
        • Audit log record schema
        • Audit field exclusion
        • Audit log filtering
      • Backup and restore
        • Overview
        • Creating a snapshot
        • Inspecting a snapshot
        • Restoring from a snapshot
        • Automated snapshots EE
      • KMS and HSM
        • HSM support EE
        • Yandex Cloud KMS
        • Double encryption (seal wrapping) EE
      • Replication EE
        • Overview
        • Performance replication
        • Disaster recovery
        • Performance standby
        • KV1/KV2 replication
      • Namespaces EE
        • Introduction
      • Cryptographic algorithms
        • Introduction
      • Extensions and Integrations
        • Introduction
        • Plugins in Standalone
        • Plugins in DP
    • Usage
      • Overview
      • Get started
        • Configuring access
        • Creating a test secret
      • Web interface
      • Auth methods
        • Overview
        • OIDC
          • JWT/OIDC method
          • Overview
          • Gitlab
          • Keycloak
          • Kubernetes
        • JWT
        • Approle
        • userpass
        • Token
        • LDAP
        • SAML EE
        • Kubernetes
        • WebAuthn
        • 2FA / MFA
          • Multifactor
          • TOTP
      • Managed Keys EE
        • Overview
      • Secrets engines
        • Overview
        • KV Secrets engine
          • KV secrets engine
          • KV/v1
          • KV/v2
          • KV1/KV2 replication
        • PKI Secrets engine
        • Cubbyhole Secrets engine
        • SSH Secrets engine
        • SSH OTP
        • Transit Secrets engine
        • TOTP Secrets engine
        • Kubernetes Secrets engine
        • LDAP Secrets engine
        • RabbitMQ
        • Identity Secrets engine
          • Overview
          • OIDC identity provider
          • OIDC identity tokens
        • Databases Secrets engine
          • Overview
          • PostgreSQL
          • MySQL
        • GitOps Secrets engine EE
          • Overview
          • Configuration format
        • trdl
      • Stronghold agent
        • Overview
        • Use cases
        • Key features
        • Basic settings
        • Launch and management
    • Architecture
      • Architecture overview
      • Deckhouse Stronghold Architecture
      • Deployment in DP
      • Standalone deployment
      • Replication architecture
      • Network ports
      • Threat model
      • Functional specifications
    • Examples
      • Overview
      • Access and sign-in
        • ALD Pro
        • Active Directory
        • SSO with OIDC
        • MFA for administrators
        • Break-glass access
      • Delivering secrets to applications
        • Kubernetes workloads
        • Application on a VM
        • CI/CD
        • GitOps
        • Terraform and Ansible
        • TLS for a web server on a VM
        • Application clients
        • Local run in Docker
        • AppRole
      • Dynamic credentials
        • Dynamic PostgreSQL credentials
        • Dynamic MySQL and MariaDB credentials
        • Dynamic ClickHouse credentials
        • Dynamic RabbitMQ users
        • Temporary Kubernetes tokens
        • Static credentials rotation
        • TOTP codes
      • Certificates
        • Internal PKI
        • cert-manager
        • ACME
        • SSH certificates
        • Service mesh
      • Encryption and keys
        • Transit encryption
        • Auto-unseal with Yandex Cloud KMS EE
        • Auto-unseal with an HSM EE
      • Operations
        • Migrating from Vault
        • Namespaces for teams
        • SIEM
        • Handing a secret to a person
        • DR drills
        • KV v2 secret versions
        • Rate limit
        • Cubbyhole
      • Stronghold as an IdP
        • OIDC provider for applications
    • Reference
      • API
        • auth
        • secrets
        • identity
        • system
      • Console utilities
        • d8 (Deckhouse CLI) ↗
        • d8 stronghold
    • Release notes

Secrets engines

Section contents:
  • Secrets engines
  • KV Secrets engine
  • PKI Secrets engine
  • Cubbyhole Secrets engine
  • SSH Secrets engine
  • SSH one-time passwords (OTP)
  • Transit Secrets engine
  • TOTP Secrets engine
  • Kubernetes Secrets engine
  • LDAP Secrets engine
  • RabbitMQ secrets engine
  • Identity Secrets engine
  • Databases Secrets engine
  • GitOps Secrets engine
  • trdl secrets engine
We use cookies to make your browsing experience more convenient. For details, see the Privacy Policy.
✕

Request trial access

Fill out the form, and we will contact you within the next business day — please stay in touch!

Select your preferred communication means

Thank you

Thank you for your interest in Deckhouse Platform!
We will contact you within the next business day regarding the details of your request — please stay in touch!

Error

Something went wrong...

✕

Request callback

Fill out this form, and we will contact you soon.

Select your preferred communication means

Thank you

We will contact you on this or the next business day

Something went wrong

Please try again later

✕

Book your sessions

Fill out this form, and we will contact you to discuss the details

Thank you

Check your email for details.

Error

Something went wrong...

✕

Request demo

Fill out this form, and we will contact you soon.

Thank you

We will contact you soon.

Error

Something went wrong...

✕

Get the PCI SSC compliance report

The document is aimed at companies that use container-based payment systems. It contains a list of common threats along with the best practices and measures we put in place to address them. Find out the extent to which Deckhouse meets the PCI SSC criteria!

By clicking the "Download the report" button, you agree to the Privacy Policy.

Thank you

The file is loaded automatically. If it doesn't, click the "Download the report" button.

Error

Something went wrong...

✕

Request partner program details

Leave your contact details, and we will contact you.

Request received

We will contact you within a business day

Error

Something went wrong...

Contacts
  • contact@deckhouse.io
  • +7 (495) 721-10-27
Products
  • Kubernetes Platform
  • Virtualization Platform
  • Observability Platform
  • Commander
  • Stronghold
  • Delivery Kit
  • Prom++
  • Code
  • Development Platform
Solutions
  • Technical Support
  • Security
  • Training & Consulting
  • Deckhouse vs KaaS
Resources
  • Success stories
  • Community
  • Documentation
  • Getting started
  • Blog
  • Privacy Policy
  • Terms of service
  • Cookie Policy
© 2026 Deckhouse. All rights reserved.