diff --git a/pkg/apis/secret/v0alpha1/keeper.go b/pkg/apis/secret/v0alpha1/keeper.go
index 5557e6e63d5..348df2ff914 100644
--- a/pkg/apis/secret/v0alpha1/keeper.go
+++ b/pkg/apis/secret/v0alpha1/keeper.go
@@ -65,6 +65,22 @@ type KeeperSpec struct {
 	HashiCorp *HashiCorpKeeperConfig `json:"hashivault,omitempty"`
 }
 
+func (s *KeeperSpec) GetType() KeeperType {
+	if s.AWS != nil {
+		return AWSKeeperType
+	}
+	if s.Azure != nil {
+		return AzureKeeperType
+	}
+	if s.GCP != nil {
+		return GCPKeeperType
+	}
+	if s.HashiCorp != nil {
+		return HashiCorpKeeperType
+	}
+	return ""
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type KeeperList struct {
 	metav1.TypeMeta `json:",inline"`
@@ -102,9 +118,6 @@ type HashiCorpCredentials struct {
 	Token   CredentialValue `json:"token"`
 }
 
-// Envelope encrytion details.
-type Envelope struct{}
-
 // Holds the way credentials are obtained.
 // +union
 type CredentialValue struct {
@@ -122,6 +135,13 @@ type CredentialValue struct {
 	ValueFromConfig string `json:"valueFromConfig,omitempty"`
 }
 
+// System Keeper.
+type SystemKeeperConfig struct{}
+
+func (s *SystemKeeperConfig) Type() KeeperType {
+	return "system"
+}
+
 // Remote Keepers.
 type AWSKeeperConfig struct {
 	AWSCredentials `json:",inline"`
diff --git a/pkg/apis/secret/v0alpha1/zz_generated.deepcopy.go b/pkg/apis/secret/v0alpha1/zz_generated.deepcopy.go
index 49975b17610..727f1e43034 100644
--- a/pkg/apis/secret/v0alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/secret/v0alpha1/zz_generated.deepcopy.go
@@ -96,22 +96,6 @@ func (in *CredentialValue) DeepCopy() *CredentialValue {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Envelope) DeepCopyInto(out *Envelope) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Envelope.
-func (in *Envelope) DeepCopy() *Envelope {
-	if in == nil {
-		return nil
-	}
-	out := new(Envelope)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GCPCredentials) DeepCopyInto(out *GCPCredentials) {
 	*out = *in
@@ -382,3 +366,19 @@ func (in *SecureValueStatus) DeepCopy() *SecureValueStatus {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SystemKeeperConfig) DeepCopyInto(out *SystemKeeperConfig) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SystemKeeperConfig.
+func (in *SystemKeeperConfig) DeepCopy() *SystemKeeperConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(SystemKeeperConfig)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/pkg/apis/secret/v0alpha1/zz_generated.openapi.go b/pkg/apis/secret/v0alpha1/zz_generated.openapi.go
index 9bb5f4753e5..de1934c36cb 100644
--- a/pkg/apis/secret/v0alpha1/zz_generated.openapi.go
+++ b/pkg/apis/secret/v0alpha1/zz_generated.openapi.go
@@ -20,7 +20,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.AzureCredentials":      schema_pkg_apis_secret_v0alpha1_AzureCredentials(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.AzureKeeperConfig":     schema_pkg_apis_secret_v0alpha1_AzureKeeperConfig(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.CredentialValue":       schema_pkg_apis_secret_v0alpha1_CredentialValue(ref),
-		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.Envelope":              schema_pkg_apis_secret_v0alpha1_Envelope(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.GCPCredentials":        schema_pkg_apis_secret_v0alpha1_GCPCredentials(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.GCPKeeperConfig":       schema_pkg_apis_secret_v0alpha1_GCPKeeperConfig(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.HashiCorpCredentials":  schema_pkg_apis_secret_v0alpha1_HashiCorpCredentials(ref),
@@ -32,6 +31,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.SecureValueList":       schema_pkg_apis_secret_v0alpha1_SecureValueList(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.SecureValueSpec":       schema_pkg_apis_secret_v0alpha1_SecureValueSpec(ref),
 		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.SecureValueStatus":     schema_pkg_apis_secret_v0alpha1_SecureValueStatus(ref),
+		"github.com/grafana/grafana/pkg/apis/secret/v0alpha1.SystemKeeperConfig":    schema_pkg_apis_secret_v0alpha1_SystemKeeperConfig(ref),
 	}
 }
 
@@ -234,17 +234,6 @@ func schema_pkg_apis_secret_v0alpha1_CredentialValue(ref common.ReferenceCallbac
 	}
 }
 
-func schema_pkg_apis_secret_v0alpha1_Envelope(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "Envelope encrytion details.",
-				Type:        []string{"object"},
-			},
-		},
-	}
-}
-
 func schema_pkg_apis_secret_v0alpha1_GCPCredentials(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -729,3 +718,14 @@ func schema_pkg_apis_secret_v0alpha1_SecureValueStatus(ref common.ReferenceCallb
 		},
 	}
 }
+
+func schema_pkg_apis_secret_v0alpha1_SystemKeeperConfig(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "System Keeper.",
+				Type:        []string{"object"},
+			},
+		},
+	}
+}