kubernetes.secret.get

Read a single Secret (data values redacted by default; pass reveal=true to include them)

Reads a single Kubernetes Secret from the cluster.

By default, secret data values are not returned — only the sorted list of data keys is included in the response. Set reveal=true to include the raw base64-encoded values exactly as Kubernetes stores them.

If the Secret exists, returns exists=True alongside a trimmed secret object. If the Secret is not found (404), returns exists=False and secret=None — no exception is raised.

Inputs:

• connection_uuid: UUID of the cloud connection (required)
• namespace: Namespace the Secret lives in (required)
• name: Secret name (required)
• reveal: When true, include base64-encoded data values in output (optional; default false)

Outputs:

• exists: bool — True when the Secret was found
• secret: JSON — trimmed Secret object, or null when not found. Fields: name, namespace, type, data_keys (sorted list), labels, annotations, created_at, and optionally data (the base64 dict) when reveal=true.

Plugin required: context.get_plugin("connection").kubernetes_runner_clients(connection_uuid, organization_uuid) must expose core_v1 with read_namespaced_secret.

Security: Data values are redacted by default to avoid accidental exposure in workflow history / MCP payloads. Callers must explicitly opt in with reveal=true.

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
namespace	string	Yes	—	—
name	string	Yes	—	—
reveal	boolean	No	—	—
organization_uuid	uuid	No	—	—

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	—
organization_uuid	uuid	No	—	—
namespace	string	No	—	—
name	string	No	—	—
reveal	boolean	No	—	—
exists	boolean	No	—	—
apiVersion	string	No	—	—
kind	string	No	—	—
metadata	json	No	—	—
spec	json	No	—	—
status	json	No	—	—
data	json	No	—	—
binaryData	json	No	—	—
stringData	json	No	—	—
immutable	boolean	No	—	—
type	string	No	—	—
rules	json	No	—	—
aggregationRule	json	No	—	—
roleRef	json	No	—	—
subjects	json	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "kubernetes.secret.get",
  "initial_data": {
    "connection_uuid": "value",
    "namespace": "value",
    "name": "value"
  }
}