From 970b783eb65d2ae94e1f8bdbe41e57434394e35c Mon Sep 17 00:00:00 2001
From: Katheryn Satterlee <kathy@fleetdm.com>
Date: Fri, 31 Jan 2025 12:58:52 -0600
Subject: [PATCH] Update secrets-in-scripts-and-configuration-profiles.md
 (#25783)

Added comments to separate env variables for use by GitOps vs secret
variables to upload to Fleet

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

Docs-only change
---
 articles/secrets-in-scripts-and-configuration-profiles.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/articles/secrets-in-scripts-and-configuration-profiles.md b/articles/secrets-in-scripts-and-configuration-profiles.md
index 5f7664a811..40500c0c29 100644
--- a/articles/secrets-in-scripts-and-configuration-profiles.md
+++ b/articles/secrets-in-scripts-and-configuration-profiles.md
@@ -20,11 +20,13 @@ For macOS and Linux scripts, if a secret doesn't have the `$FLEET_SECRET_` prefi
 
 ```yaml
     env:
+      ###  Variables used by the gitops workflow ###
       FLEET_URL: ${{ secrets.FLEET_URL }}
       FLEET_API_TOKEN: ${{ secrets.FLEET_API_TOKEN }}
       FLEET_GLOBAL_ENROLL_SECRET: ${{ secrets.FLEET_GLOBAL_ENROLL_SECRET }}
       FLEET_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.FLEET_WORKSTATIONS_ENROLL_SECRET }}
       FLEET_WORKSTATIONS_CANARY_ENROLL_SECRET: ${{ secrets.FLEET_WORKSTATIONS_CANARY_ENROLL_SECRET }}
+      ### Secrets uploaded to Fleet for use in profiles and scripts ###
       FLEET_SECRET_CERT_PASSWORD: ${{ secrets.FLEET_SECRET_CERT_PASSWORD }}
       FLEET_SECRET_CERT_BASE64: ${{ secrets.FLEET_SECRET_CERT_BASE64 }}
 ```