Skip to content

docs: move secret reference writes to the pe toolset #622

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rashadism merged 3 commits into from
May 15, 2026
+14 −5
Merged

docs: move secret reference writes to the pe toolset #622

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6845e15
docs: move secret reference writes to the pe toolset
rashadism May 15, 2026
373b993
docs: simplify get_secret_reference parenthetical
rashadism May 15, 2026
d54415b
docs: drop redundant toolset parenthetical on get_secret_reference
rashadism May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions docs/reference/mcp-servers.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,11 +67,10 @@ If your integration depends on the legacy `*_cluster_*` names, migrate to the ca

- `list_namespaces` — List all namespaces (top-level containers for organizing projects, components, and resources)
- `create_namespace` — Create a new namespace
- `list_secret_references` — List all secret references (credentials and sensitive configuration) for a namespace
- `get_secret_reference` — Get a single secret reference's full spec (template, data sources, refresh interval, target plane). For sync status, query `get_resource_events` (PE toolset; enable PE alongside Namespace) against the rendered ExternalSecret on the data plane
- `create_secret_reference` — Create a new secret reference; spec must include `template` (Kubernetes Secret type) and `data[]` (mapping of secret keys to external store references)
- `update_secret_reference` — Update an existing secret reference; annotations are merged, spec is replaced wholesale when provided
- `delete_secret_reference` — Delete a secret reference (the underlying Kubernetes Secret is removed by the controller)
- `list_secret_references` ‡ — List all secret references (credentials and sensitive configuration) for a namespace
- `get_secret_reference` ‡ — Get a single secret reference's full spec (template, data sources, refresh interval, target plane). For sync status, query `get_resource_events` against the rendered ExternalSecret on the data plane

‡ Also registered on the PE toolset. Authoring secret references (`create_`, `update_`, `delete_secret_reference`) is PE-only — see the PE toolset below.

</details>

Expand Down Expand Up @@ -283,6 +282,16 @@ The PE toolset is enabled by default. These tools are intended for platform admi
- `update_authz_role_binding` — Update an existing authz role binding (full replacement)
- `delete_authz_role_binding` — Delete an authz role binding

**Secret References**

- `list_secret_references` ‡ — List all secret references (credentials and sensitive configuration) for a namespace
- `get_secret_reference` ‡ — Get a single secret reference's full spec (template, data sources, refresh interval, target plane). For sync status, query `get_resource_events` against the rendered ExternalSecret on the data plane
- `create_secret_reference` — Create a new secret reference; spec must include `template` (Kubernetes Secret type) and `data[]` (mapping of secret keys to external store references)
- `update_secret_reference` — Update an existing secret reference; annotations are merged, spec is replaced wholesale when provided
- `delete_secret_reference` — Delete a secret reference (the underlying Kubernetes Secret is removed by the controller)

‡ Also registered on the Namespace toolset so developers can list and inspect secret references without enabling PE.

**Diagnostics**

- `get_resource_tree` — Get the rendered resource tree for a release binding
Expand Down