Back to Secrets Module

Releases

Secrets Module for Ignition 8.3

Every published version of the module, with the Ignition version it has been verified against and the secrets managers it talks to, plus a direct download for the .modl asset and the user manual.

  1. v0.3.0

    v0.3.05 Aug 2026

    External secret providers for Ignition 8.3: referenced secrets in database connections, OPC and email profiles, and system.secrets scripts resolve directly from an external secrets manager. The estate release: hub-and-spoke deployments verified end to end.

    Ignition:
    8.3.3+ (gateway scope only)
    Providers:
    HashiCorp Vault, Azure Key Vault, AWS Secrets Manager or Google Secret Manager

    Changes

    • Licensed module. The EULA ships inside the .modl and is shown on install. The module is fully functional during Ignition's standard trial period, and a purchased licence is activated under Platform > System > Licensing.
    • Provider types for HashiCorp Vault (KV v2 and database engine static roles, with token, AppRole and Kubernetes auth), Azure Key Vault (client secret and managed identity), AWS Secrets Manager (access key and EC2 instance role) and Google Secret Manager (service account key and GCE/GKE metadata server).
    • A Cached Provider that wraps any other provider, built for the platform's Remote provider in hub-and-spoke estates.
    • Caching with last-known-good fallback, so a vault outage does not take the plant down. Every cached serve is audited.
    • Credential rotation without a maintenance window. A rotated secret is picked up without a Gateway restart or a dropped connection.
    • Hub-and-spoke estates are verified end to end. Edge Gateways consume the central Gateway's providers over the Gateway Network, and the audit trail attributes each access to the Gateway that made it (gan-remote-gateway-name=<edge>).
    • The manual includes an estate setup guide covering both deny-by-default security layers that gate secrets access over the Gateway Network.
    • Outbound-only by construction. There are no listening sockets and no inbound firewall rules to open, and the module bundles no third-party jars.
    • The minimum Ignition version is 8.3.3. Versions 8.3.0 to 8.3.2 predate the platform's secret-reference machinery.
    Download Mustry-Secrets.modl(143 KB)Download Mustry-Secrets-User-Manual-v0.3.0.pdf(268 KB)