Skip to content

Remove caching from secret management config guide #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nscuro merged 1 commit into from
May 3, 2026
+1 −22
Merged

Remove caching from secret management config guide #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 1 addition & 22 deletions docs/guides/administration/configuring-secret-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
# Configuring secret management

Dependency-Track supports pluggable secret storage providers.
This guide covers provider selection, encryption key management,
and caching configuration.
This guide covers provider selection and encryption key management.
Comment thread
nscuro marked this conversation as resolved.

For creating, updating, and deleting secrets in the app,
see [Managing secrets](../user/managing-secrets.md).
Expand Down Expand Up @@ -322,26 +321,6 @@ The provider may be configured using the following properties:
dt.secret-management.provider=env
```

## Caching

To reduce provider load and improve performance, secret values can be cached
in memory. This is configured via:

* [`dt.secret-management.cache.enabled`](../../reference/configuration/properties.md#dtsecret-managementcacheenabled)
* [`dt.secret-management.cache.expire-after-write-ms`](../../reference/configuration/properties.md#dtsecret-managementcacheexpire-after-write-ms)
* [`dt.secret-management.cache.max-size`](../../reference/configuration/properties.md#dtsecret-managementcachemax-size)

!!! info
Caching is applied transparently regardless of which provider is configured.
When enabled, decrypted secret values are cached for the configured duration.

!!! warning
Cached secrets are invalidated when they get updated or deleted.
This only applies to the node that performed the update or deletion.
Other nodes in the cluster rely on the time-based invalidation.
Take this into consideration when enabling the cache and configuring
the `expire-after-write-ms` option.

[AES-GCM-256]: https://en.wikipedia.org/wiki/Galois/Counter_Mode
[AWS secrets manager]: https://aws.amazon.com/secrets-manager/
[Azure Key Vault]: https://azure.microsoft.com/en-us/products/key-vault
Expand Down