Skip to content

Commit 4d9ee3f

Browse files
sriramveeraghantasriramveeraghanta
authored
Update external secrets #111 
2 parents c5b576c + 209c6e4 commit 4d9ee3f

File tree

1 file changed

+49
-51
lines changed

1 file changed

+49
-51
lines changed

‎self-hosting/govern/external-secrets.mdx

Lines changed: 49 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -74,51 +74,50 @@ This guide explains how to integrate Plane with external secret management solut
7474

7575
9. Apply the following YAML to create a ClusterSecretStore resource:
7676
```yaml
77-
apiVersion: external-secrets.io/v1beta1
77+
apiVersion: external-secrets.io/v1
7878
kind: ClusterSecretStore
7979
metadata:
80-
name: cluster-aws-secretsmanager
80+
name: cluster-aws-secretsmanager
81+
namespace: <application_namespace>
8182
spec:
82-
provider:
83+
provider:
8384
aws:
84-
service: SecretsManager
85-
role: arn:aws:iam::<ACCOUNT-ID>:role/<IAM ROLE>
86-
region: eu-west-1
87-
auth:
88-
secretRef:
85+
service: SecretsManager
86+
role: arn:aws:iam::<ACCOUNT-ID>:role/<IAM ROLE>
87+
region: eu-west-1
88+
auth:
8989
accessKeyIDSecretRef:
90-
name: aws-creds-secret
91-
key: access-key
90+
name: aws-creds-secret
91+
key: access-key
9292
secretAccessKeySecretRef:
93-
name: aws-creds-secret
94-
key: secret-access-key
93+
name: aws-creds-secret
94+
key: secret-access-key
9595
```
9696
Replace `<ACCOUNT-ID>` and `<IAM ROLE>` with your AWS account ID and the role name created in Step 5.
9797

9898
10. Create an ExternalSecret resource to fetch secrets from AWS and create a corresponding Kubernetes secret:
9999
```yaml
100-
apiVersion: external-secrets.io/v1beta1
100+
apiVersion: external-secrets.io/v1
101101
kind: ExternalSecret
102102
metadata:
103-
name: secret
104-
namespace: <application_namespace>
103+
name: rabbitmq-external-secrets
104+
namespace: <application_namespace>
105105
spec:
106-
refreshInterval: 1m
107-
secretStoreRef:
106+
refreshInterval: 1m
107+
secretStoreRef:
108108
name: cluster-aws-secretsmanager # ClusterSecretStore name
109109
kind: ClusterSecretStore
110-
target:
110+
target:
111111
name: rabbitmq-secret # Target Kubernetes secret name
112112
creationPolicy: Owner
113-
data:
114-
- secretKey: RABBITMQ_DEFAULT_USER # Specifies the key name for the secret value in the Kubernetes secret.
113+
data:
114+
- secretKey: RABBITMQ_DEFAULT_USER
115115
remoteRef:
116-
key: prod/secrets/rabbitmq # Specifies the name to the secret in the AWS Secrets Manager
117-
property: RABBITMQ_DEFAULT_USER # Specifies the name of the secret property to retrieve from the AWS Secrets Manager
118-
- secretKey: RABBITMQ_DEFAULT_PASS
116+
key: prod/secrets/rabbitmq
117+
property: RABBITMQ_DEFAULT_USER
118+
- secretKey: RABBITMQ_DEFAULT_PASS
119119
remoteRef:
120-
key: prod/secrets/rabbitmq
121-
property: RABBITMQ_DEFAULT_PASS
120+
key: prod/secrets/rabbitmq
122121
```
123122

124123
Make sure to set all [environment variables](/self-hosting/methods/kubernetes#external-secrets-config) in the AWS Secrets Manager, and then access them via ExternalSecret resources in your Kubernetes cluster.
@@ -145,49 +144,48 @@ Make sure to set all [environment variables](/self-hosting/methods/kubernetes#ex
145144

146145
5. Apply the following YAML to create a ClusterSecretStore resource:
147146
```yaml
148-
# cluster-store.yaml
149-
apiVersion: external-secrets.io/v1beta1
150-
kind: ClusterSecretStore
147+
apiVersion: external-secrets.io/v1
148+
kind: ClusterSecretStore
151149
metadata:
152-
name: vault-backend
150+
name: vault-backend
151+
namespace: <application_namespace>
153152
spec:
154-
provider:
155-
vault:
156-
server: "https://<vault-domain>" #the address of your vault instance
157-
path: "secrets" #path for accessing the secrets
158-
version: "v2" #Vault API version
159-
auth:
153+
provider:
154+
vault:
155+
server: "https://<vault-domain>" # the address of your vault instance
156+
path: "secrets" # path for accessing the secrets
157+
version: "v2" # Vault API version
158+
auth:
160159
tokenSecretRef:
161-
name: "vault-token" #Use a k8s secret called vault-token
162-
key: "token" #Use this key to access the vault token
160+
name: "vault-token" # Use a k8s secret called vault-token
161+
key: "token" # Use this key to access the vault token
163162
```
164163

165164
Replace `<vault-domain>` with your Vault server address.
166165

167166
6. Create an ExternalSecret resource to fetch secrets from Vault and create a corresponding Kubernetes secret:
168167
```yaml
169-
apiVersion: external-secrets.io/v1beta1
168+
apiVersion: external-secrets.io/v1
170169
kind: ExternalSecret
171170
metadata:
172-
name: rabbitmq-external-secrets
173-
namespace: <application_namespace> # application-namespace
171+
name: rabbitmq-external-secrets
172+
namespace: <application_namespace> # application-namespace
174173
spec:
175-
refreshInterval: "1m"
176-
secretStoreRef:
174+
refreshInterval: "1m"
175+
secretStoreRef:
177176
name: vault-backend # ClusterSecretStore name
178177
kind: ClusterSecretStore
179-
target:
178+
target:
180179
name: rabbitmq-secret # Target Kubernetes secret name
181-
creationPolicy: Owner
182-
data:
183-
- secretKey: RABBITMQ_DEFAULT_USER # Specifies the key name for the secret value stored in the Kubernetes secret.
180+
creationPolicy: Owner
181+
data:
182+
- secretKey: RABBITMQ_DEFAULT_USER
184183
remoteRef:
185-
key: secrets/data/rabbitmq_secrets # Specifies the name to the secret in the Vault secret store.
186-
property: RABBITMQ_DEFAULT_USER # Specifies the name of the secret property to retrieve from the Vault secret store.
187-
- secretKey: RABBITMQ_DEFAULT_PASS
184+
key: secrets/data/rabbitmq_secrets
185+
property: RABBITMQ_DEFAULT_USER
186+
- secretKey: RABBITMQ_DEFAULT_PASS
188187
remoteRef:
189-
key: secrets/data/rabbitmq_secrets
190-
property: RABBITMQ_DEFAULT_PASS
188+
key: secrets/data/rabbitmq_secrets
191189
```
192190

193191
Follow this pattern to manage all the environment variables in the Vault, then access them via ExternalSecret resources in your Kubernetes cluster.

0 commit comments

Comments
 (0)