Solutions
Solutions
One page that answers “does every target still match its source?”, without anyone seeing a value.
A daily drift check
Know which targets drifted since the last scheduled run.
- The collector runs on a schedule; the viewer always shows the latest state.
- Stale targets stand out, so a broken collector is not mistaken for a clean fleet.
After a rotation
Confirm that every target picked up the new value.
- Rotate in the source, sync with env-sync, then look for
drifton the affected keys. - Fingerprints show the target matches without anyone seeing the new value.
A read-only view for reviewers
Give people the drift picture without giving them any credential.
- Viewer users need a confirmed address on the allowlist, nothing more.
- Their database role can only select, and they never receive a value or a fingerprint.