⚠️ Experimental — Binds StackGen Vault secret refs to a remote runner.
When refs are attached, mothership merges vault KV into GET /remote-runners/public/secrets/sync responses. aiden-runner holds synced values in memory only. With no refs, sync returns empty env (use local K8s Secret / Vault Agent). OAuth refresh tokens must not be attached.
Append sync_cli_args to sg_remote_runner.cli_start_command only for a non-default poll interval.
# When to use: Push Vault secret refs to an aiden-runner so on-prem agents get
# AWS/GCP/GitHub/etc. credentials via secrets sync (held in runner memory only).
# Skip this resource when the runner loads secrets from local K8s Secret / Vault Agent.
#
# Prerequisites: sg_remote_runner (or look up an existing runner by name);
# sg_secret IDs for typed/generic refs. Do NOT attach OAuth refresh tokens.
#
# Related: sg_remote_runner (registration + cli_start_command), sg_secret,
# sg_agent.remote_runners (attach runner to agents that need on-prem tools).
#
# Append sync_cli_args to sg_remote_runner.cli_start_command only when the poll
# interval is not the default 60s.
resource "sg_remote_runner" "example" {
name = "onprem-runner"
description = "Outbound-only runner for private network tools."
}
resource "sg_remote_runner_secrets" "example" {
# Plan-time known name (API also accepts server UUID).
runner_id = sg_remote_runner.example.name
typed_secret_refs = {
aws = "00000000-0000-4000-8000-000000000010" # replace with sg_secret.*.id
github = "00000000-0000-4000-8000-000000000011"
}
generic_secret_ref_ids = [
"00000000-0000-4000-8000-000000000012",
]
secrets_sync_interval_seconds = 120
}
Import an existing sg_remote_runner_secrets using its runner UUID:
terraform import sg_remote_runner_secrets.example '123e4567-e89b-12d3-a456-426614174000'
Vault secret references must exist before binding them to the runner. Secure Terraform state and plans containing credential references.
runner_id (String) Remote runner identifier (same as sg_remote_runner.name / runner_id). Changing forces replacement.generic_secret_ref_ids (List of String) Unbounded list of generic vault secret UUIDs merged into runner env at sync time.secrets_sync_interval_seconds (Number) Poll interval hint for aiden-runner –secrets-sync-interval (sync heartbeat only; mothership does not push secret values). Not stored on mothership; used only for sync_cli_args when not the default 60s.typed_secret_refs (Map of String) Vault secret UUIDs keyed by subcategory (aws, azure, gcp, github, kubernetes). Values must be sg_secret IDs whose metadata keys become runner env vars at sync time.sync_cli_args (String) Optional CLI flags to append to sg_remote_runner.cli_start_command when secrets_sync_interval_seconds is not 60 (e.g. –secrets-sync-interval 120s). Empty when the default 60s interval applies.