diff --git a/secrets.yaml.template b/secrets.yaml.template
new file mode 100644
index 0000000000..27089d0a7c
--- /dev/null
+++ b/secrets.yaml.template
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: spaces-secrets
+  namespace: mumble
+type: Opaque
+data:
+  # Kubernetes secrets must be base64-encoded:
+  # echo -n 'original_string' | base64
+  aws_access_key_id: NONE=
+  aws_secret_access_key: NONE=