POLLEN CONFIG
Encrypted at rest. Injected at boot. Versioned. Your workloads never see a plaintext secret on disk.
HOW IT WORKS
Secrets are encrypted client-side before reaching the API. AES-256-GCM with per-secret key envelopes. The platform KMS manages the root keys.
Encrypted payloads are persisted with version history. Every mutation is logged in the audit trail. Secrets are scoped to project and environment.
At workload boot, Nectar resolves declared secret references and injects them as WASI environment variables. No filesystem writes. No network calls from your code.
FEATURES
Every secret update creates a new immutable version. Roll back instantly. Compare versions side by side. Audit who changed what and when.
Separate secrets per environment: dev, staging, production. Promote secrets between environments with a single command. No copy-paste.
Define rotation policies. Pollen generates new values, encrypts, and injects them on the next workload boot. Zero downtime rotation.
Control who can read, write, and rotate each secret. Scoped to teams, projects, or individual workloads. Integrated with Keystone IAM.