Vault

The vault stores reusable values that your configurations need, so a value lives in one place instead of being repeated across configs. Open Vault from the navigation. The vault has three sections:

Every active member of the organization can view org variables and variable groups. Creating, editing, and deleting them requires the Contributor or Admin role. See Members & roles.

Organization variables

An organization variable is a shared text value, such as a URL, hostname, or environment name, with an org-wide default. Each variable has a name, a reference name, and a value. Values are masked in the table and can be viewed individually.

To add one, select Add Org Variable, then set a name, a Reference Name, and a value. The reference name must be uppercase and contain only letters, numbers, and underscores; it is the name you use in configurations.

Reference an organization variable

In a configuration field, type @ to open the org-variable autocomplete. Selecting a variable inserts a $orgvar: token, such as $orgvar:PROD_API_URL. The token stays in the stored YAML: Telflo resolves it for each collector when the collector checks in. Update the value once in the vault, and every collector whose configuration references it receives the new value on its next check-in, without a new configuration version.

During editor validation and test runs, each token is replaced with the variable's org-default value in a transient copy; the stored configuration keeps its tokens, and variable-group overrides are not applied. See Validation.

Change guards

• An org variable that a deployed configuration version references cannot be deleted, and its reference name cannot be changed. Undeployed drafts produce a warning instead.
• A configuration that references an undefined $orgvar: token cannot be assigned to a deploy group. Define the variable first. Pinning an individual collector to a version skips this check, and an undefined token in a pinned version is delivered to the collector unresolved.

Variable groups

A variable group is a named set of value overrides on top of the org defaults. Use variable groups to give different environments different values for the same variables, such as a production endpoint and a development endpoint, while every configuration references one token.

1. In Org Variable Groups, select Add Group and name the group.
2. Open the group and select Select Variables to add org variables to it.
3. Select Edit Override on a variable to set the group's value. An override left blank inherits the org default.

A variable group takes effect when it is assigned to a deploy group: on a fleet's Deploy Groups tab, set the Assigned variable group for the group. The default is None (org defaults only). Fleet instance tables show each collector's variable group in the Variable Group column, with org defaults when none applies. See Create a fleet.

Deleting a variable group does not delete the org variables in it; deploy groups assigned to it fall back to the org defaults.

Resolution order

A collector resolves each $orgvar: token with the first value that applies:

1. The collector's pinned variable group, on Kubernetes supervisor fleets in private preview.
2. The override in the variable group assigned to the collector's deploy group.
3. The org variable's default value.

Kubernetes bridge fleets resolve org defaults only. User variables never participate in this chain.

User variables

User variables are personal to your account. Each has a name, a reference name, and a value. The value is hidden in the table by default and can be revealed.

To add one, select Add Variable, then set a name, a reference name, and a value.

In a configuration field, type # to open the user-variable autocomplete. Selecting a variable inserts its value into the field, so the generated YAML contains the literal value. Updating a user variable in the vault does not change configurations that already contain its value; use an organization variable for values that should stay updatable in one place.