> For the complete documentation index, see [llms.txt](https://v2.dataos.info/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://v2.dataos.info/operate/v1/dataos-operator/design-tenants/create-mandatory-secrets.md).

# Create mandatory Secrets

Once the [Data Plane and Compute](/operate/v1/dataos-operator/design-tenants/create-tenants.md#2-attach-the-data-plane-and-compute) are attached, apply the two state store connection Secrets required by Vulcan in each Tenant. These Secrets provide Vulcan with access to the **PostgreSQL state store and object store provisioned during infrastructure setup**.

Each Secret holds the connection details for one state store, so Vulcan can read and write the state it depends on.

#### **PostgreSQL state store connection**

Credentials for the PostgreSQL instance provisioned for the Data Plane (Amazon RDS on AWS, Azure Database for PostgreSQL on Azure). In Vulcan, the **state store** is where Vulcan keeps track of the current state of the project.

In simple words, it is Vulcan’s memory.

It records what has already happened, what is currently active, and what needs to change next. This helps Vulcan avoid repeating work and safely manage updates across environments.

The state store can keep information like:

* Which models or queries have already been processed
* Which version of a model is currently active
* What changed between the previous run and the current run
* Which environments exist, such as development, staging, or production
* What data intervals or time ranges have already been loaded
* Which cached or generated outputs are connected to the current project state

#### **Object store connection**

In Vulcan, the **object store** is a storage location where Vulcan saves cached query outputs.

When a query is executed, Vulcan generates results files that can be reused later. Instead of running the same query again, Vulcan can read those saved results from the object store. This helps reduce compute cost, improve performance, and make results available across different users or environments.

## Why are these connections required?

The connection details for these storage locations are provided to Vulcan through two mandatory Secrets. Hence, Both storage locations must be available before you create the Secrets. Collect the connection details required for your PostgreSQL database and object store, including their authentication credentials.

Create and apply the following Secrets in the Tenant:

{% hint style="warning" %}
Both Secrets are Tenant-scoped. Create them in every Tenant you provision; they are not shared or inherited across Tenants.
{% endhint %}

## Steps

### **Create Postgres state store Secret**

Mandatory name: `vulcan-state-connection`

```
name: vulcan-state-connection
version: v2alpha
type: secret
layer: user
secret:
  type: key-value
  data:
    USERNAME: "${{ POSTGRES_USERNAME }}"
    PASSWORD: "${{ POSTGRES_PASSWORD }}"
    HOST: "${{ POSTGRES_HOST }}"
    PORT: "5432"
    DATABASE: "${{ POSTGRES_DATABASE }}"
```

### **Create object store state store Secret**

Mandatory name: `vulcan-object-store-connection`

Choose the configuration corresponding to your object-store source and create the Secret using the applicable manifest.

#### Amazon S3

```yaml
name: vulcan-object-store-connection
version: v2alpha
type: secret
layer: user
secret:
  type: key-value
  data:
    STORAGE_FORMAT: "s3"
    AWS_ACCESS_KEY: "${{ ACCESS_KEY }}"
    AWS_SECRET_KEY: "${{ SECRET_KEY }}"
    BUCKET: "${{ BUCKET_NAME }}"
    RELATIVE_PATH: "dataos-state-store"
    AWS_ENDPOINT: "https://s3.${{ REGION }}.amazonaws.com"
    AWS_REGION: "${{ REGION }}"
```

#### Azure Blob Storage

{% tabs %}
{% tab title="Key authentication" %}

```yaml
name: vulcan-object-store-connection
version: v2alpha
type: secret
layer: user
secret:
  type: key-value
  data:
    STORAGE_FORMAT: "azure"
    RELATIVE_PATH: "${{ RELATIVE_PATH }}"
    AZURE_CONTAINER: "${{ CONTAINER_NAME }}"
    AZURE_STORAGE_ACCOUNT: "${{ STORAGE_ACCOUNT_NAME }}"
    AZURE_STORAGE_KEY: "${{ STORAGE_ACCOUNT_KEY }}"
```

{% endtab %}

{% tab title="Service principal" %}

```yaml
name: vulcan-object-store-connection
version: v2alpha
type: secret
layer: user
secret:
  type: key-value
  data:
    STORAGE_FORMAT: "azure"
    RELATIVE_PATH: "${{ RELATIVE_PATH }}"
    AZURE_CONTAINER: "${{ CONTAINER_NAME }}"
    AZURE_STORAGE_ACCOUNT: "${{ STORAGE_ACCOUNT_NAME }}"
    AZURE_TENANT_ID: "${{ TENANT_ID }}"
    AZURE_CLIENT_ID: "${{ CLIENT_ID }}"
    AZURE_CLIENT_SECRET: "${{ CLIENT_SECRET }}"
```

{% endtab %}
{% endtabs %}

#### Google Cloud Storage

```yaml
name: vulcan-object-store-connection
version: v2alpha
type: secret
layer: user
secret:
  type: key-value
  data:
    STORAGE_FORMAT: "gcs"
    RELATIVE_PATH: "${{ RELATIVE_PATH }}"
    BUCKET: "${{ BUCKET_NAME }}"
    GCS_PROJECT_ID: "${{ GCP_PROJECT_ID }}"
    GCS_CREDENTIALS_FILE: |
      {
        "type": "service_account",
        "project_id": "${{ GCP_PROJECT_ID }}",
        "private_key_id": "${{ PRIVATE_KEY_ID }}",
        "private_key": "${{ PRIVATE_KEY }}",
        "client_email": "${{ SERVICE_ACCOUNT_EMAIL }}",
        "client_id": "${{ CLIENT_ID }}",
        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
        "token_uri": "https://oauth2.googleapis.com/token",
        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
        "client_x509_cert_url": "${{ CLIENT_X509_CERT_URL }}",
        "universe_domain": "googleapis.com"
      }
```

{% hint style="info" %}
These examples show all supported sources together for reference. Use separate manifests when configuring different object stores.
{% endhint %}

### **Apply Secrets in the Tenant**

Copy the path or relative path.

```bash
dataos-ctl resource apply -f vulcan-state-connection.yaml
dataos-ctl resource apply -f vulcan-object-store-connection.yaml
```

Both Secrets exist in the Tenant and are readable by DataOS components that require them.

### **Verify the creation**

List the Secrets in the Tenant to confirm both were created.

```yaml
dataos-ctl resource get -t secret
```

Expected Output:

```bash
INFO[0000] 🔍 get... 
INFO[0000] 🔍 get...complete 

              NAME               | VERSION |  TYPE  | WORKSPACE | STATUS | RUNTIME |     OWNER      
---------------------------------|---------|--------|-----------|--------|---------|----------------
 vulcan-state-connection         | v2alpha | secret |           | active |         | iamgroottmdcio 
 vulcan-object-store-connection  | v2alpha | secret |           | active |         | iamgroottmdcio
```

Both Secrets should appear with **STATUS** `active`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://v2.dataos.info/operate/v1/dataos-operator/design-tenants/create-mandatory-secrets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.