Skip to content
This repository was archived by the owner on Jul 26, 2022. It is now read-only.

Commit afe1b25

Browse files
authored
docs: unsplit the GCP documentation (#683)
1 parent 3442d19 commit afe1b25

File tree

1 file changed

+32
-33
lines changed

1 file changed

+32
-33
lines changed

README.md

Lines changed: 32 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -713,6 +713,38 @@ Create the policy binding:
713713

714714
gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:$CLUSTER_PROJECT.svc.id.goog[$SECRETS_NAMESPACE/kubernetes-external-secrets]" my-secrets-sa@$PROJECT.iam.gserviceaccount.com
715715

716+
##### Deploy kubernetes-external-secrets using a service account key
717+
718+
Alternatively you can create and mount a kubernetes secret containing google service account credentials and set the GOOGLE_APPLICATION_CREDENTIALS env variable.
719+
720+
Create a Kubernetes secret called gcp-creds with a JSON keyfile from a service account with necessary credentials to access the secrets:
721+
722+
apiVersion: v1
723+
kind: Secret
724+
metadata:
725+
name: mysecret
726+
type: Opaque
727+
stringData:
728+
gcp-creds.json: |-
729+
$KEYFILE_CONTENT
730+
731+
Uncomment GOOGLE_APPLICATION_CREDENTIALS in the values file as well as the following section:
732+
733+
env:
734+
AWS_REGION: us-west-2
735+
POLLER_INTERVAL_MILLISECONDS: 10000 # Caution, setting this frequency may incur additional charges on some platforms
736+
LOG_LEVEL: info
737+
METRICS_PORT: 3001
738+
VAULT_ADDR: http://127.0.0.1:8200
739+
GOOGLE_APPLICATION_CREDENTIALS: /app/gcp-creds/gcp-creds.json
740+
741+
filesFromSecret:
742+
gcp-creds:
743+
secret: gcp-creds
744+
mountPath: /app/gcp-creds
745+
746+
This will mount the secret at /app/gcp-creds/gcp-creds.json and make it available via the GOOGLE_APPLICATION_CREDENTIALS environment variable.
747+
716748
### IBM Cloud Secrets Manager
717749

718750
kubernetes-external-secrets supports fetching secrets from [IBM Cloud Secrets Manager](https://cloud.ibm.com/catalog/services/secrets-manager)
@@ -749,39 +781,6 @@ spec:
749781
secretType: username_password
750782
```
751783

752-
753-
##### Deploy kubernetes-external-secrets using a service account key
754-
755-
Alternatively you can create and mount a kubernetes secret containing google service account credentials and set the GOOGLE_APPLICATION_CREDENTIALS env variable.
756-
757-
Create a Kubernetes secret called gcp-creds with a JSON keyfile from a service account with necessary credentials to access the secrets:
758-
759-
apiVersion: v1
760-
kind: Secret
761-
metadata:
762-
name: mysecret
763-
type: Opaque
764-
stringData:
765-
gcp-creds.json: |-
766-
$KEYFILE_CONTENT
767-
768-
Uncomment GOOGLE_APPLICATION_CREDENTIALS in the values file as well as the following section:
769-
770-
env:
771-
AWS_REGION: us-west-2
772-
POLLER_INTERVAL_MILLISECONDS: 10000 # Caution, setting this frequency may incur additional charges on some platforms
773-
LOG_LEVEL: info
774-
METRICS_PORT: 3001
775-
VAULT_ADDR: http://127.0.0.1:8200
776-
GOOGLE_APPLICATION_CREDENTIALS: /app/gcp-creds/gcp-creds.json
777-
778-
filesFromSecret:
779-
gcp-creds:
780-
secret: gcp-creds
781-
mountPath: /app/gcp-creds
782-
783-
This will mount the secret at /app/gcp-creds/gcp-creds.json and make it available via the GOOGLE_APPLICATION_CREDENTIALS environment variable.
784-
785784
#### Usage
786785

787786
Once you have kubernetes-external-secrets installed, you can create an external secret with YAML like the following:

0 commit comments

Comments
 (0)