Secrets - Documentation

Secrets are secure credentials stored within the Shakti Studio platform that allow the platform to access external systems such as cloud accounts, container registries, model sources, or Kubernetes clusters. Secrets typically include:

Access keys
API tokens
Service account credentials
Cluster authentication details

All secrets are stored securely and are only used for the specific integrations or deployments where they are referenced.

Why secrets are used

Secrets are required to:

Access cloud infrastructure for cluster creation or import
Pull containers from private registries
Download models from external sources
Authenticate with Kubernetes clusters

Using secrets ensures credentials are not exposed in plain text, access can be centrally managed, and integrations can be reused across deployments.

Add a Secret

Navigate to Secrets Management

Go to Integrations → Secrets in the Shakti Studio UI.

Initiate Secret Creation

Click the Create Secret button to open the secret creation form.

List of secrets with Create Secret button

Define Secret Details

Enter a descriptive secret name and choose the appropriate secret type from the dropdown menu (e.g., AWS, GCP, Azure, Docker Hub, Hugging Face, Kubernetes, Generic).

Create secret form showing name and type fields

Input Credentials

Paste the credentials in the specified JSON format into the provided text area. Refer to the sections below for the required structure for each secret type.

Save the Secret

Click Create to securely store the secret.

Once created, the secret is available for use across your organization’s integrations and deployments.

Edit a Secret

Navigate to Secrets Management

Go to Integrations → Secrets.

Select and Edit

Locate the secret you wish to modify from the list, then click the Edit button in the top-right corner.

Secret detail view with Edit button highlighted

Update Credentials

Adjust the credentials in the JSON format as needed.

Save Changes

Click Save Changes to update the secret.

Cloud Credentials

Cloud credentials enable Shakti Studio to interact with your cloud infrastructure for tasks such as creating or importing Kubernetes clusters, managing storage resources, and deploying workloads.

The specific permissions required depend on the actions Shakti Studio will perform (e.g., cluster creation vs. ongoing maintenance). For initial setup, broader access simplifies configuration and can be refined to a more restrictive policy afterward.

Best practices for cloud credentials

Use Dedicated Accounts

Allocate a dedicated cloud account, project, or subscription specifically for Shakti Studio operations to isolate resources and permissions.

Apply Least Privilege

Grant only the minimum necessary permissions required for Shakti Studio to perform its functions.

Rotate Credentials Regularly

Implement periodic rotation of access keys and API tokens to reduce the risk of compromise.

Avoid Root Credentials

Never use personal or root account credentials. Always use service accounts or roles with specific, limited permissions.

AWS
GCP
Azure

AWS secrets allow Shakti Studio to create or manage EKS clusters and access storage resources.

Required credentials

access_key_id
secret_access_key

IAM policies

S3 Access: Required for model storage, logs, and artifacts. Permissions: s3:ListBucket, s3:GetObject, s3:PutObject.
EKS Full Access (Create Cluster): Recommended policies: AmazonEKSClusterPolicy, AmazonEKSServicePolicy, or AdministratorAccess for initial setup.
EKS Maintenance Access (Import Cluster): Node group access, cluster read/write operations, networking updates.

Best practices

Create a separate AWS sub-account for Shakti Studio.
Avoid using root credentials.
Use role-based access where possible.

AWS

{
  "access_key_id": "<access_key>",
  "secret_access_key": "<secret_key>"
}

GCP secrets allow Shakti Studio to manage GKE clusters and access storage.

Required credentials

Provide the JSON service account key for a dedicated service account.

IAM policies

GCS Access: Required for model storage, logs, and artifacts. Recommended role: Storage Object Admin.
GKE Full Access (Create Cluster): Recommended roles: Kubernetes Engine Admin, Compute Admin.
GKE Maintenance Access (Import Cluster): Recommended roles: Kubernetes Engine Developer, cluster read/write permissions.

Best practices

Create a separate GCP project for Shakti Studio.
Use a dedicated service account.
Avoid using personal credentials.

GCP

{
  "auth_provider_x509_cert_url": "<auth_provider_x509_cert_url>",
  "auth_uri": "<auth_uri>",
  "client_email": "<client_email>",
  "client_id": "<client_id>",
  "client_x509_cert_url": "<client_x509_cert_url>",
  "private_key": "<private_key>",
  "private_key_id": "<private_key_id>",
  "project_id": "<project_id>",
  "token_uri": "<token_uri>",
  "type": "<account_type>",
  "universe_domain": "<universe_domain>"
}

Azure secrets allow Shakti Studio to manage AKS clusters and storage resources.

Required credentials

tenant_id
client_id
client_secret
subscription_id

IAM policies

Azure Blob Storage Access: Recommended role: Storage Blob Data Contributor.
AKS Full Access (Create Cluster): Recommended role: Contributor on the subscription or resource group.
AKS Maintenance Access (Import Cluster): Recommended role: Contributor on the cluster resource group.

Best practices

Create a separate resource group for Shakti Studio.
Use a dedicated service principal.
Avoid using global subscription credentials.

Azure

{
  "client_id": "<client_id>",
  "client_secret": "<client_secret>",
  "subscription_id": "<subscription_id>",
  "tenant_id": "<tenant_id>"
}

Container Registries

Container registry secrets enable Shakti Studio to pull private container images for your deployments and model serving.

Docker Hub
Depot
Nvidia Docker Secret

Docker Hub secrets are used to pull private container images from Docker Hub repositories. Use a Personal Access Token instead of your account password.

Set up a personal access token

Log in to Docker Hub.
Go to Account Settings → Security.
Create a new Access Token and copy it.
Add it as a secret in Shakti Studio.

Best practices

Use read-only tokens where possible.
Create a dedicated organization for Shakti Studio images.

Docker Hub

{
  "username": "<docker_hub_username>",
  "password": "<docker_hub_access_token>"
}

Depot secrets enable pulling private containers stored in Depot registries.

Set up a personal access token

Log in to Depot.
Generate a personal access token from your project settings.
Add the token as a secret in Shakti Studio.

Best practices

Use a dedicated registry or repository for Shakti Studio.
Restrict token scope to required repositories.

Depot

{
  "username": "x-token",
  "token": "<personal_access_token>"
}

NVIDIA Docker secrets provide access to NVIDIA model containers and other resources on NVIDIA NGC (nvcr.io).

Set up an NGC API key

Log in to the NVIDIA NGC portal.
Generate an API key from your account settings.
Add it as a secret in Shakti Studio.

Best practices

Use a dedicated account for Shakti Studio.
Limit token scope to required images.

Nvidia Docker Secret

{
  "server": "nvcr.io",
  "password": "<ngc_api_key>",
  "username": "$oauthtoken"
}

Model Sources

Model source secrets allow Shakti Studio to access and download private or gated models from external platforms.

Hugging Face
GitHub

Hugging Face secrets enable the download of private or gated models from the Hugging Face Hub.

Set up an access token

Log in to Hugging Face.
Go to Settings → Access Tokens.
Create a new token with at least Read access.
Copy the token and add it as a secret in Shakti Studio.

Best practices

Use tokens with read-only access.
Grant access only to the repositories you need.

Hugging Face

{
  "token": "<huggingface_access_token>"
}

GitHub secrets allow Shakti Studio to access models or containers stored in private GitHub repositories or GitHub Container Registry (GHCR).

Set up a personal access token

Log in to GitHub.
Go to Settings → Developer settings → Personal access tokens.
Generate a new token with the required repository or package read permissions.
Copy the token and add it as a secret in Shakti Studio.

Best practices

Use fine-grained tokens scoped to only the repositories you need.
Grant read-only access.

GitHub

{
  "token": "<github_personal_access_token>"
}

Kubernetes Cluster Credentials

Kubernetes cluster credentials store the authentication details needed to connect Shakti Studio to an existing Kubernetes cluster. These are used when importing clusters or deploying workloads to an imported cluster.

Token-based and certificate-based authentication cannot be used together. Choose only one method.

Best practices

Use a dedicated cluster for Shakti Studio workloads.
Avoid sharing clusters with unrelated production systems.

Token-based
Certificate-based

Authenticate using a service account token:

Kubernetes — Token

{
  "token": "<service_account_token>",
  "server": "<cluster_api_server_url>",
  "ca_certificate": "<base64_encoded_ca_certificate>"
}

Authenticate using client certificates:

Kubernetes — Certificate

{
  "server": "<cluster_api_server_url>",
  "client_key": "<base64_encoded_client_key>",
  "ca_certificate": "<base64_encoded_ca_certificate>",
  "client_certificate": "<base64_encoded_client_certificate>"
}

Shakti Cloud S3

Shakti Cloud S3 secrets allow Shakti Studio to access storage hosted on the Shakti Cloud S3-compatible object store.

Reach out to the Shakti Cloud team to obtain credentials for Shakti Cloud S3.

Shakti Cloud S3

{
  "endpoint_url": "<endpoint_url>",
  "access_key_id": "<access_key_id>",
  "secret_access_key": "<secret_access_key>"
}

Generic Secrets

Generic secrets provide a flexible way to securely store any custom credentials or sensitive information not covered by the specific secret types above. These can include third-party API keys, custom authentication tokens, or other environment variables.

Go to Integrations → Secrets.
Click Create Secret.
Select Generic as the secret type.
Enter key-value pairs in the required JSON format.
Click Create to save.

Generic

{
  "KEY_NAME": "VALUE"
}

​Why secrets are used

​Add a Secret

​Edit a Secret

​Cloud Credentials

Use Dedicated Accounts

Apply Least Privilege

Rotate Credentials Regularly

Avoid Root Credentials

​Required credentials

​IAM policies

​Best practices

​Required credentials

​IAM policies

​Best practices

​Required credentials

​IAM policies

​Best practices

​Container Registries

​Set up a personal access token

​Best practices

​Set up a personal access token

​Best practices

​Set up an NGC API key

​Best practices

​Model Sources

​Set up an access token

​Best practices

​Set up a personal access token

​Best practices

​Kubernetes Cluster Credentials

​Shakti Cloud S3

​Generic Secrets

Why secrets are used

Add a Secret

Edit a Secret

Cloud Credentials

Required credentials

IAM policies

Best practices

Required credentials

IAM policies

Best practices

Required credentials

IAM policies

Best practices

Container Registries

Set up a personal access token

Best practices

Set up a personal access token

Best practices

Set up an NGC API key

Best practices

Model Sources

Set up an access token

Best practices

Set up a personal access token

Best practices

Kubernetes Cluster Credentials

Shakti Cloud S3

Generic Secrets