Manage device credentials
Hold device credentials as references to your own vault, bind them to devices, and let Orb agents resolve them only when a job runs.
Device discovery needs to log in to your devices. You keep those credentials in one place, under Fleet management → Credentials, so they never end up in an agent configuration file on a host.
Public Preview - Fleet Management is in Public Preview for NetBox Cloud customers. Contact your account team to enable it for your organization.
How credentials work
The Console stores a reference, not a secret. When you create a credential you give it a path into your own HashiCorp Vault, such as my/path. That path is what the Console keeps. The secret value stays in your vault.
Your agent resolves the reference. When a Discovery job runs, the Console passes the reference to the Orb agent inside the job policy. The agent looks the value up in your vault, using the vault settings you supplied in its provisioning command, and uses it to log in to the device.
That has two practical effects:
- Device secrets stay in your vault. NetBox Labs never stores them.
- The agent's vault settings and the references in the Console need to match. If an agent has no vault settings, or points at a different vault, jobs won't be able to log in. See Manage Orb agents.
Before you begin
- A HashiCorp Vault or OpenBao instance holding your device credentials, reachable from the host running your Orb agent.
- An Orb agent started with vault settings in its provisioning command.
Create a credential
- Go to Fleet management → Credentials and select New Credential.
- Give the credential a name.
- Note the type. Username + Password is currently the only type you can create during the preview, so the type is shown rather than chosen.
- Note the target. Device is the only target, and it cannot be changed after the credential is created.
- Enter the username. By default the Is Vault reference checkbox is selected and the field is labelled Username reference, expecting a path like
my/path. Clear the checkbox to type a literal username instead. - Enter the Password reference. This is always a reference. There is no way to store a literal password, by design.
- Save the credential.
Write references as bare paths. A reference is my/path, not ${my/path}. The Console rejects a value containing ${ or }.
Bind a credential to devices
A credential does nothing until it is bound to the devices it unlocks.
- Open the credential from Fleet management → Credentials.
- Select Add device and choose the devices this credential applies to.
You can also assign credentials while creating a Discovery job, without leaving the wizard. The Scope step lists every device in scope, and a Credential filter set to Missing shows you exactly which devices still need one. See Run Discovery jobs.
A device job will not be created until every device in scope has a credential. The platform enforces this and refuses the whole job rather than running against part of it. Each device holds one credential per type.
Rotate a secret
Because the Console stores only a path, rotating the secret in your vault is invisible to it. The next job resolves the same path and picks up the new value. You only need to edit a credential when you want it to point somewhere else.
Edit a credential
Open the credential and select Edit, then Save changes.
Limits during the preview
- Username and password is currently the only type you can create.
- HashiCorp Vault is currently the only secret store the Console references, with OpenBao supported through the same path.
How this relates to the Orb agent's own secrets managers
The Orb agent secrets manager documentation covers CyberArk, Delinea, Doppler, DSV, and Vault. Both statements are true, and they describe different halves of the system.
The agent can read from any of those stores when you configure it yourself. What Fleet Management can hold and hand to an agent is a HashiCorp Vault reference. So an agent you configure by hand keeps its full range of secret stores, while credentials managed centrally in the Console use Vault. Support for more stores in the Console is planned.
Troubleshooting
A job fails on authentication. The reference does not resolve. Check that the path exists in your vault and that the agent running the job has vault settings pointing at the same vault.
Saving a credential fails with a message about reserved characters. The reference contains ${ or }. Enter the bare path.
A device job will not create. One or more devices in scope have no credentials. Use the Credential filter in the wizard's Scope step, set to Missing, to find them.
What's next
Getting help
Contact your account team or NetBox Labs support.