> For the complete documentation index, see [llms.txt](https://docs.ozone.one/ozone-end-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ozone.one/ozone-end-user-guide/~/changes/7YIrhOgqbpKF1lkWsq0G/guides/securing-delivery/secret-management-for-delivery-workflows.md).

# Secret Management for Delivery Workflows

### Overview

Ozone ships with an in-built Vault to manage all of the provider secrets, variables and securely injects them into the CI/CD context when pipelines are being executed. These variables can be pre-defined in the Variables section, or they can be defined when a provider is being integrated.

When a pipeline or a release run is triggered, these variables are fetched from the in-built vault and supplied into the Kubernetes Secrets for the pipeline pods to be consumed. The following diagram shows the a concise view of how the secrets from Ozone are injected into the context of a CI/CD pipeline

### Secret Management Workflow

The diagram below presents a summary of how Ozone handles secrets within the pipeline workflows

![](https://3829750647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAObcOkMb6sCSnSdcUOTm%2Fuploads%2F8BBxUv04Mo2ikEWF5ZTi%2Fvault%20\(1\).png?alt=media\&token=4c57bf42-34fa-46ce-9d31-58f724d11e77)

{% hint style="info" %}
Any secrets that are required by the CI/CD workflows can be scoped as variables which can have one value per environment, or a global value across all environments. 

**Secret Management is enabled by default for all CI/CD workflows in Ozone**
{% endhint %}