Skip to main content

​
Overview

Runlayer stores Sentry Relay credentials in WorkOS Vault under runlayer-sentry-credentials. Keep the credential source outside Git and deliver it through the deployment platform’s secret mechanism. Expected fields:

​
Kubernetes with Runlayer Operator

Sync Vault values into a Kubernetes Secret in the tenant namespace. The default Secret name is runlayer-sentry-relay; required keys are public_key, secret_key, and id. Enable the component in RunlayerInstance:
Use spec.components.sentryRelay.secretRef when the Secret name or key names differ. See Optional component Secrets. Do not place Relay credentials in instance values. Use External Secrets, Terraform, or the customer’s approved secret-delivery controller.

​
ECS with Terraform

The ECS module fetches Relay credentials through its WorkOS Vault integration and injects them into the Relay task. sentry_relay_enabled defaults to true; check the selected module release before planning. When enabled, the data.external.relay_credentials data source runs scripts/vault-fetch-relay.sh. Terraform can execute this helper during refresh/plan, before any apply; reads with unknown inputs may instead be deferred to apply. The helper receives auth_api_key and uses it as a Bearer credential to list and read the Relay secret from WorkOS Vault at https://api.workos.com by default. Review any WORKOS_API_BASE override on the Terraform runner. Configure the key through the normal secret input; never print the helper’s input/output or commit credential values. The helper fetches secret values, so a plan is not limited to cloud resource metadata reads. Confirm this credential use and the runner’s WorkOS access before planning. If Vault reads are not approved, explicitly choose sentry_relay_enabled = false before a plan; this also disables Relay. Do not disable it silently to bypass a failed check. If credentials are unavailable, keep Relay disabled or provide an explicit Sentry DSN according to the ECS module contract.

​
Rotation

  1. Rotate the credential in WorkOS Vault.
  2. Sync the destination secret.
  3. Restart or roll out the affected workload.
  4. Verify Relay health and backend event delivery.

​
Troubleshooting

  • Missing Secret: confirm namespace, Secret name, and key selectors.
  • Relay disabled: confirm spec.components.sentryRelay.enabled.
  • Vault fetch failure: confirm the WorkOS API key can read the credential.
  • No events: verify outbound HTTPS to Sentry and the Relay configuration.

​
Security

  • Never commit credential values.
  • Restrict Secret read access to the Relay workload and deployment controller.
  • Rotate immediately after suspected exposure.
  • Audit Vault reads and Kubernetes Secret updates.