Storage, database, and secrets¶

Create a dedicated S3 bucket in the same AWS region as your EKS cluster. Naming rules: 3–63 characters, lowercase letters, numbers, and hyphens only; globally unique across all AWS accounts.

1
2
3

aws s3api create-bucket \
  --bucket <bucket-name> \
  --region <region>

Keep server-side encryption (SSE-S3 or SSE-KMS) enabled and leave block-public-access enabled (the default). The IAM role from Cloud permissions must have S3 access to this bucket.

1

aws s3 ls s3://<bucket-name>

You need a storage account and a blob container inside it, both in the same Azure region as your AKS cluster.

1
2
3
4
5

az storage account create \
  --name <storage-account-name> \
  --resource-group <resource-group> \
  --location <location> \
  --sku Standard_LRS

1
2
3

az storage container create \
  --name <container-name> \
  --account-name <storage-account-name>

The managed identity from Cloud permissions needs the Storage Blob Data Contributor role on this container.

Create a bucket in the same GCP region as your GKE cluster. Naming rules: 3–63 characters — lowercase letters, numbers, hyphens, and underscores; globally unique across all GCP projects. Uniform bucket-level access is recommended; keep public access prevention enabled.

1
2
3
4

gcloud storage buckets create gs://<bucket-name> \
  --location=<region> \
  --uniform-bucket-level-access \
  --public-access-prevention

The service account from Cloud permissions needs Storage Object Admin on this bucket.

1

gcloud storage ls gs://<bucket-name>

Trust3 creates the StorageClass, so the only prerequisite is the EBS CSI driver on the cluster:

1

kubectl get csidriver ebs.csi.aws.com

Install the AWS EBS CSI Driver if it is missing. A missing driver shows up as a pod stuck in Pending with an unbound volume claim.

Choose EFS when a stateful pod must be able to restart in a different availability zone. EFS is regional, so it allows that, at the cost of slower per-volume performance and a file system you create and pay for per plane.

Create an EFS file system in the same VPC and region as your EKS cluster, with security groups allowing NFS traffic (port 2049) between the EKS nodes and the EFS mount targets. Install the AWS EFS CSI Driver.

1

deleteAccessPointRootDir: true

1
2

args:
- --delete-access-point-root-dir=true

1

kubectl get pods -A -l 'app.kubernetes.io/name=aws-efs-csi-driver'

1

kubectl get csidriver efs.csi.aws.com

1

aws efs describe-file-systems --query 'FileSystems[*].{Name:Name,Id:FileSystemId}' --output table

The EFS ID cannot be changed after setup.

Choose this when you need control that the StorageClass Trust3 creates does not give you: a specific KMS key, a different provisioner or volume type, or a cluster where the runtime must stay namespace-scoped.

The StorageClass must already exist on the cluster before you create the plane. Trust3 does not create one in this mode, and the runtime installs into its own namespace without cluster-scoped StorageClass permissions.

Confirm it exists, then enter its name in the wizard:

1

kubectl get sc <storageclass-name>

The name cannot be changed after the plane is created.

No setup. Credentials are encrypted in your browser using a per-runtime public key and stored in the Trust3 database.

A single secret in the runtime namespace; each connector credential is one key in its data map. If a value changes later, restart the affected connector from the portal.

1
2
3
4

kubectl create secret generic <runtime-name>-secrets \
  -n <runtime-name> \
  --from-literal=my-credential='dummy-value' \
  --dry-run=client -o yaml | kubectl apply -f -

A secret in the same region as your cluster; connector credentials are keys in its JSON payload. Access is granted through the IAM role in Cloud permissions.

1
2
3
4

aws secretsmanager create-secret \
  --name <secret-name> \
  --region <region> \
  --secret-string '{}'

Create a vault in the same region as your AKS cluster; each connector credential is an individual secret in the vault. The vault name must be globally unique (3–24 characters, alphanumeric and hyphens only). If a secret changes later, restart the affected connector from the portal.

1
2
3
4

az keyvault create \
  --name <key-vault-name> \
  --resource-group <resource-group> \
  --location <location>

The managed identity from Cloud permissions needs the Key Vault Secrets User role on the vault.

A secret in the same project as your GKE cluster. If a value changes later, restart the affected connector from the portal.

1
2
3

echo -n '{}' | gcloud secrets create <secret-name> \
  --data-file=- \
  --replication-policy=automatic

The service account from Cloud permissions needs Secret Manager Secret Accessor.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

SECRET_NAME='<secret-name>'
NAMESPACE='<runtime-name>'
ANTHROPIC_API_KEY='<YOUR_ANTHROPIC_API_KEY>'

kubectl create namespace "$NAMESPACE" || true

kubectl create secret generic "$SECRET_NAME" \
  --namespace "$NAMESPACE" \
  --from-literal=anthropic_api_key="$ANTHROPIC_API_KEY" \
|| kubectl patch secret "$SECRET_NAME" \
     --namespace "$NAMESPACE" \
     --type merge \
     -p "{\"stringData\":{\"anthropic_api_key\":\"$ANTHROPIC_API_KEY\"}}"

This creates the namespace if it does not exist, then creates the secret, or adds anthropic_api_key to it when the secret is already there.

The secret is a single JSON document that can already hold other credentials, such as the database connection keys, so the key is merged into it rather than written over it:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

SECRET_NAME='<secret-name>'
REGION='<region>'
ANTHROPIC_API_KEY='<YOUR_ANTHROPIC_API_KEY>'

EXISTING=$(aws secretsmanager get-secret-value --secret-id "$SECRET_NAME" --region "$REGION" --query SecretString --output text 2>&1) || case "$EXISTING" in
  *ResourceNotFoundException*) EXISTING='{}' ;;
  *) printf '%s\n' "$EXISTING" >&2; EXISTING='' ;;
esac

MERGED=''
[ -n "$EXISTING" ] && MERGED=$(printf '%s' "$EXISTING" \
  | jq --arg key "$ANTHROPIC_API_KEY" '. + {anthropic_api_key: $key}')

if [ -z "$MERGED" ]; then
  echo "Could not read the current secret - nothing was written." >&2
else
  aws secretsmanager create-secret \
    --name "$SECRET_NAME" \
    --region "$REGION" \
    --secret-string "$MERGED" \
  || aws secretsmanager put-secret-value \
       --secret-id "$SECRET_NAME" \
       --region "$REGION" \
       --secret-string "$MERGED"
fi

If the secret cannot be read, nothing is written, so credentials already in it are never replaced by this key alone.