Unified secrets control plane for cloud-native teams.
Approvals · RBAC · audit · least-privilege agent execution
across HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and Kubernetes / GitOps.
Control Plane (the brain) = decisions, workflow, metadata, audit, RBAC, jobs, status
Agent = least-privilege execution inside the target account / cluster
Providers = the actual secret values (source of truth)
The Control Plane never holds your secret values or broad provider access. A lightweight, outbound-only agent runs inside each target boundary and executes approved jobs locally with scoped credentials.
Developers need a safe way to request and update secrets without broad provider access. Security teams need approvals, separation of duties, and an audit trail. Platform teams need cross‑provider sync with drift and conflict visibility.
One brain, every provider. Secrets Bridge brings governance and synchronization together in one platform — without replacing the tools your teams already use.
| Repo | What it is |
|---|---|
| core | Shared Go module — provider connectors, sync engine, shared types |
| api | Control Plane API (Go + Fiber) |
| worker | Background workers (Go) |
| agent | Outbound-only, least-privilege execution agent (Go) |
| controller | Kubernetes operator + CRDs for SecretsSync (GitOps) |
| ui | Dashboard SPA (React + TypeScript + Vite) |
| charts | Helm charts / deploy manifests |
| docs | Documentation site → secrets-bridge.io |
- No central store of secret values — compromising the control plane exposes nothing.
- Agents are outbound-only and least-privilege, with no database or cache dependency.
- Every privileged action is audited with a correlation ID.
- Provider access is scoped by account, project, environment, path, tag, or policy.
Wordmark · icon set · favicon · Bridgey the mascot — all in profile/. Canonical design source: the Figma file Secrets Bridge — Brand.
🚧 Status: actively refactoring from a Kubernetes sync controller (v0.1.0) into the full control plane platform.