Secrets must be added directly, not via pull