[TEEP-5473] Document multi_secret_backends for multiple native secret backends#37920
[TEEP-5473] Document multi_secret_backends for multiple native secret backends#37920ian28223 wants to merge 5 commits into
Conversation
… backends Adds documentation for the multi_secret_backends feature (Agent 7.80+): - Config structure with named backends (type + config per entry) - ENC[backendName;secretKey] handle format and semicolon delimiter rules - Precedence over secret_backend_command / secret_backend_type - Partial resolution behavior and secret output example - Step-by-step migration guide from secret_backend_type Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Preview links (active after the
|
|
/review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🤖 Automated review by Claude. AI-generated; verify before acting.
New section documenting multi_secret_backends (Agent 7.80+). Two clarity issues worth addressing before merge: a numeric inconsistency in the sample output that will confuse users, and a heading that breaks the surrounding Option 1/2/3 structure of the parent section. Also flagged one gap around backend name constraints.
Reviewed 396c49a11fd52999a4f375f4a7b4b5db5010f2fa — workflow run
…constraint - Rename heading to "Option 1b" to preserve Option 1/2/3 numbered flow - Fix resolved secret count (2 → 1) to match the sample output - Note that backend names cannot contain semicolons Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jeff-morgan-dd
left a comment
jeff-morgan-dd
left a comment
There was a problem hiding this comment.
Please see query on "1b" numbering - thank you!
…section - Add Single backend / Multiple backends sub-headings under Option 1 - Remove secret_backend_timeout mentions - Rephrase precedence as numbered list - Drop Partial resolution section - Rename "ENC handle format" to "ENC notation" - Clarify "backend delimiter" wording Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…case rule Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jeff-morgan-dd
left a comment
jeff-morgan-dd
left a comment
There was a problem hiding this comment.
Thanks for updating the architecture, this looks great!
|
|
||
| #### Multiple backends | ||
|
|
||
| **Available in Agent version 7.80+** |
There was a problem hiding this comment.
Suggestion - maybe this could be italics instead; on the page this basically renders looking identical to the H4 heading name right above it which is a bit difficult to parse.
Also, do we want to say Agent version 7.80+?
These are non-blocking but just items to consider - thanks!
2 participants
What does this PR do? What is the motivation?
Fixes TEEP-5473
Documents the
multi_secret_backendsfeature (Agent 7.80+, datadog-agent #47987), which lets you declare multiple named native secret backends and route secrets to a specific backend using theENC[backendName;secretKey]handle format.New section added under Option 1 ("Using multiple native backends simultaneously"):
multi_secret_backendswith named entries, each withtypeandconfig)ENC[backendName;secretKey]handle format, including the first-semicolon-only delimiter rule for keys that contain semicolonssecret_backend_command→secret_backend_type→multi_secret_backendsdatadog-agent secretoutputsecret_backend_typeMerge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Used Claude Code for research (PR diff and release notes extraction), drafting the new section, and applying edits.
Additional notes