Works with the pipelines, platforms and files you already use
In CI, Crunu is one command, crunu run, with a token bound to your provider. On servers, it's an agent with a systemd service. This page lists only what works today, and says which parts are built in and which are a recipe.
CI pipelines3
Bind a service token to your CI provider with OIDC, so it works only in the pipeline you name and gets only the environments you grant.
GitHub ActionsBuilt in
Bind a token to a repository, branch and environment with OIDC; the agent fetches GitHub's token itself.
GitLab CIBuilt in
Bind a token to a project path, ref and environment with id_tokens, or extend the .crunu job templates.
Bitbucket PipelinesBuilt in
Bind a token to a repository, branch and deployment with the step's OIDC token and your own audience.
Other CI systems. Keep a service token in the CI's secrets and run steps with crunu run. Any issuer that publishes OIDC discovery can be used for a CI binding. Any CI with a service token
Cloud platforms for your own server3
Deploy your own Crunu server with one script. The server stores only ciphertext wherever it runs, and moves between platforms with one archive.
Cloudflare WorkersBuilt in
Deploy your own server to Workers with D1 in one script.
VercelBuilt in
Host your own server on Vercel with Neon, or push values into Vercel from CI.
Google Cloud RunBuilt in
Deploy your own server to Cloud Run with Cloud SQL or Neon and Secret Manager.
Your servers and containers2
Run the server with Docker Compose, and run the crunu agent as a sandboxed systemd service that hands variables to your programs.
Files and formats2
Keep credentials files as they're written, and export an environment to a format other tools open.
AWS credentials filesBuilt in
Keep ~/.aws/credentials and ~/.aws/config with their sections, and put them back with one command.
Ansible VaultBuilt in
Export an environment to keys.vault.yml that opens with ansible-vault view.
What isn't connected
Everything above works today. These are the gaps, so you can plan around them.
No built-in sync to cloud secret stores
Crunu doesn't push values into Vercel environment variables, Cloudflare secrets, AWS Secrets Manager or GitHub Secrets. A pipeline can push them with crunu run and the platform's own CLI.
No Kubernetes or Terraform
There's no Kubernetes operator, Helm chart or CSI driver, no Terraform provider and no SDKs. Programs get their values through crunu run.
Chat and paging tools through webhooks only
Slack, Microsoft Teams and PagerDuty receive Crunu alerts through their incoming webhooks; there's no dedicated app for them.
No imports from other vaults
Crunu doesn't import from 1Password, HashiCorp Vault, Doppler or Infisical. Drag your files into an environment instead.
AWS App Runner isn't listed
The server has a deploy script for it, but AWS has closed App Runner to new customers.
Questions and answers
Not covered here? Write to support@crunu.com and a person will answer.
Is the GitHub Action on the Marketplace?
No. The setup-crunu action is two files you copy into your repository, so it goes through your own review. The same steps also work as three plain commands.
Which CI providers can bind a token with OIDC?
GitHub Actions, GitLab CI and Bitbucket Pipelines, plus any issuer that publishes OIDC discovery. Other CI systems can use a service token on its own.
Do I need to host Crunu on one of these platforms?
No. Crunu runs at app.crunu.com. The hosting integrations are for teams that run their own server. The server isn't published as a public download. Write to support@crunu.com.
Can Crunu sync secrets into my cloud provider?
Not by itself. A pipeline can push values with crunu run and the provider's CLI, as the Vercel page shows.
Does Crunu run on Windows?
No. The crunu agent runs on Linux and macOS, on amd64 and arm64.
Connect your first pipeline
Create a service token for staging, paste the CI setup into your pipeline, and run your tests with crunu run. Free during early access.