What is the Vault?

The Vault is where you store and manage cryptographic keys, TLS certificates, image-pull registries, and encrypted credentials on Bahriya. Every type follows the same lifecycle — versioned, attached per project, materialised inside the containers that use it — so you learn the model once and apply it everywhere.

Vault item types

How it works

1. Create a vault item in your organisation. Bahriya encrypts the sensitive material at rest and extracts metadata (certificate subject, expiry date, key fingerprint) so you can see it at a glance.
2. Attach the item to one or more projects. This is when billing starts for the attached rate.
3. Wire the item to containers within those projects. For TLS bundles, this means choosing a mount path where the certificate files appear inside the container.
4. Rotate when needed. A new version is created and marked current. Previous versions are retained (default: last 5) for instant rollback. Every vault and config list shows each item's current version (for example v2 of 3) and when it was last rotated, which reads Never until the first rotation. After a rollback it shows the date of the version you rolled back to.

See Project Attachments for a deeper walkthrough of the attach + wire flow across all 11 types, including the in-use detach guard and the wiring shape per type.

Billing

Each vault item type has two rates:

• Base rate charged per month while the item exists in your organisation
• Attached rate charged per region per month while attached to a project

See the pricing page for current rates.

Platform-managed items

Some items are created and maintained by the platform on behalf of one of your resources, and are marked Managed in the console:

• a TLS bundle issued for a Valkey or MySQL instance that serves TLS without one of your own bundles;
• the secret holding a Valkey instance's auth password (Connecting to Valkey);
• the secrets holding a MySQL instance's root and database user passwords (Connecting to MySQL);
• the encryption keys of a MySQL instance with encryption at rest: an escrow of its MySQL encryption keys and, with the volume encryption add-on, its volume passphrase (Encryption at rest).

You can see a managed item and its versions, and use it from your containers once it is attached, but you cannot edit, rotate, detach or delete it directly. Change it through the resource that owns it; it is removed when that resource no longer needs it. Managed items are billed at the same base and attached rates as any other item of their type.

A TLS bundle's CA certificate and server certificate are public — the server presents them to every client — so the console shows them with copy and download buttons. Download the CA certificate to let your clients verify the server (for MySQL, pass it with --ssl-ca). The private key is never shown. A platform-managed bundle is renewed automatically 30 days before its certificate expires and is always reissued from the same CA, so a CA certificate you downloaded keeps working. It gets a new CA only when you replace it from the owning instance (for MySQL, see Replacing the CA). With Reis, reis tls_bundle:show <handle> --ca prints the CA certificate on its own.

Managing vault items

You can manage vault items through:

• The Console UI under your organisation's Vaults section
• The Reis CLI using commands like reis tls_bundle:create, reis tls_bundle:rotate
• The Terraform provider using resources like bahriya_tls_bundle
• The API directly at /organisations/{id}/tls_bundles (and similar endpoints per type)

See also

• TLS Bundles (Terraform)
• TLS Bundles (Reis YAML)
• TLS Bundles (Reis Flags)
• X.509 Certificates (Terraform)
• X.509 Certificates (Reis YAML)
• X.509 Certificates (Reis Flags)