Skip to content

Commit 33562f5

Browse files
kquinn1204kquinn1204
committed
Adding secret content
1 parent 7f7505c commit 33562f5

File tree

2 files changed

+64
-82
lines changed

2 files changed

+64
-82
lines changed

‎content/learn/getting-started-secret-management.adoc‎

Lines changed: 63 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -18,53 +18,88 @@ Secrets refer to any piece of sensitive information that should not be exposed p
1818

1919
A simple way to think of secrets is as anything that security teams or responsible system administrators would ensure stays protected and not published in a public space.
2020

21-
== Characteristics and Importance
2221
Secrets are crucial for the functioning of applications for example database passwords or cache keys. Without access to these secrets, applications may fail or operate in a significantly impaired manner.
2322

2423
Secrets often vary between different deployments of the same application for example separate load balancer certificates for different instances. Using the same secret across multiple deployments is generally discouraged as it increases the risk of exposure
2524

2625
Applications often need secrets to run correctly, making them indispensable. Removing or mishandling secrets can disrupt operations.
2726

28-
== Security and Management Concerns
29-
Directly storing secrets in Git repositories is problematic as this can lead to accidental exposure. Secrets should be managed securely and kept out of source control systems.
30-
Secrets can come in many formats and may have various naming conventions (e.g., usernames and passwords might have different labels). Applications can have strict or specific requirements for how secrets are presented, necessitating flexibility in their management.
27+
== How Validated Patterns implements secrets management
3128

32-
== Challenges in Handling Secrets
33-
Secrets must be handled carefully to prevent exposure, especially in a GitOps framework where the desired state is stored as code. While storing non-sensitive information (e.g., container images, version numbers) in a Git repository is safe, secrets require additional security measures.
34-
Administrators must ensure that different secret formats are managed properly and can be adapted to meet the specific needs of various applications.
29+
Validated Patterns supports the tokenization approach for secret management. Tokenization involves keeping actual secret values out of version control (for example git) by using tokens or references that can pull secrets from secure storage during runtime. The real secrets are pulled from an external storage system at runtime.
3530

36-
== Configuring secrets
31+
This approach requires integration with external secret management systems some examples of which are HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and CyberArk's Conjur.
3732

38-
Multicloud GitOps is a foundational pattern that demonstrates GitOps principles for managing applications across multiple clusters. It provides:
33+
The External Secrets Operator (ESO) is integral to the validated patterns framework, enabling secure secret management by fetching secrets from various secret stores and projecting them into Kubernetes namespaces. ESO supports integration with providers such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP, IBM Secrets Manager, and others.
3934

40-
* A GitOps framework using ArgoCD
41-
* Infrastructure-as-Code practices
42-
* Multi-cluster management capabilities
43-
* Template for secure secret management
35+
ESO
4436

45-
The Multicloud GitOps pattern is recommended as your first pattern because:
46-
47-
. It establishes core GitOps practices
48-
. Provides a minimal but complete implementation
49-
. Serves as a foundation for other patterns
50-
. Demonstrates key validated patterns concepts
37+
* Supports a range of secret providers, ensuring no vendor lock-in.
38+
* Keeps secrets out of version-controlled repositories, using token references in Git instead.
39+
* Allows teams to manage secrets securely while maintaining efficient Git workflows.
5140

5241
[NOTE]
5342
====
54-
Other patterns build upon these concepts, making this an ideal starting point for your validated patterns journey.
43+
As of December 12, 2023, ESO is not officially supported by Red Hat as a product.
5544
====
5645

57-
== Deploying the Multicloud GitOps pattern
46+
ESO's custom file format and utilities streamlines secret management by allowing file references and supporting encrypted secret storage. The design prioritizes security through multi-layer encryption and simplifies key management. In particular the ini key type is especially helpful for handling AWS credentials, where mismanagement could lead to unauthorized use and potential financial or operational issues.
47+
48+
Validated Patterns primary backend secret store is HashiCorp Vault It acts as a centralized service for securely managing secrets, such as passwords, API keys, and certificates.
49+
50+
Unlike other secret management systems tied to specific cloud providers for example AWS Secrets Manager or Azure Key Vault, Vault can be deployed across different clouds, on bare-metal systems, and in hybrid environments. This cross-platform support made it a popular and practical choice for maintaining a consistent secrets management strategy.
5851

52+
== Configuring Secrets
5953

54+
Secret management in validated patterns follows GitOps best practices while maintaining security. Here's how to configure your secrets:
6055

61-
//Include Procedure module here
62-
[id="installing-validated-patterns-operator_{context}"]
63-
== Installing the {validated-patterns-op}
56+
=== Using Vault for Secret Management
6457

58+
. Access the Vault instance deployed by the pattern
59+
. Initialize Vault and obtain root tokens
60+
. Configure secret engines:
61+
+
62+
[source,bash]
63+
----
64+
vault secrets enable -path=secret kv-v2
65+
----
6566

66-
//Include Procedure module here
67-
[id="create-pattern-instance_{context}"]
68-
== Creating the Multicloud GitOps instance
67+
=== Storing Pattern Secrets
6968

70-
.
69+
. Create a new secret:
70+
+
71+
[source,bash]
72+
----
73+
vault kv put secret/pattern-name/credentials \
74+
username="admin" \
75+
password="secure-password"
76+
----
77+
78+
. Reference secrets in your GitOps configurations:
79+
+
80+
[source,yaml]
81+
----
82+
apiVersion: v1
83+
kind: Secret
84+
metadata:
85+
name: pattern-secret
86+
stringData:
87+
credentials: ${vault:secret/data/pattern-name/credentials}
88+
----
89+
90+
[TIP]
91+
====
92+
For more detailed information about secret management, refer to the comprehensive guide at https://validatedpatterns.io/learn/
93+
====
94+
95+
== Next Steps
96+
97+
* Explore the deployed components in your OpenShift console
98+
* Review the GitOps repositories created by the pattern
99+
* Try modifying the configuration to understand the GitOps workflow
100+
* Consider exploring other validated patterns that build on this foundation
101+
102+
[IMPORTANT]
103+
====
104+
Remember to consult the official documentation at validatedpatterns.io for detailed information about specific features and advanced configurations.
105+
====

‎content/learn/quickstart.adoc‎

Lines changed: 1 addition & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -53,57 +53,4 @@ Before beginning, ensure you have the following:
5353
* Local Git repository with pattern manifests
5454
* Proper network policies configured
5555

56-
== Configuring Secrets
57-
58-
Secret management in validated patterns follows GitOps best practices while maintaining security. Here's how to configure your secrets:
59-
60-
=== Using Vault for Secret Management
61-
62-
. Access the Vault instance deployed by the pattern
63-
. Initialize Vault and obtain root tokens
64-
. Configure secret engines:
65-
+
66-
[source,bash]
67-
----
68-
vault secrets enable -path=secret kv-v2
69-
----
70-
71-
=== Storing Pattern Secrets
72-
73-
. Create a new secret:
74-
+
75-
[source,bash]
76-
----
77-
vault kv put secret/pattern-name/credentials \
78-
username="admin" \
79-
password="secure-password"
80-
----
81-
82-
. Reference secrets in your GitOps configurations:
83-
+
84-
[source,yaml]
85-
----
86-
apiVersion: v1
87-
kind: Secret
88-
metadata:
89-
name: pattern-secret
90-
stringData:
91-
credentials: ${vault:secret/data/pattern-name/credentials}
92-
----
93-
94-
[TIP]
95-
====
96-
For more detailed information about secret management, refer to the comprehensive guide at https://validatedpatterns.io/learn/
97-
====
98-
99-
== Next Steps
100-
101-
* Explore the deployed components in your OpenShift console
102-
* Review the GitOps repositories created by the pattern
103-
* Try modifying the configuration to understand the GitOps workflow
104-
* Consider exploring other validated patterns that build on this foundation
105-
106-
[IMPORTANT]
107-
====
108-
Remember to consult the official documentation at validatedpatterns.io for detailed information about specific features and advanced configurations.
109-
====
56+

0 commit comments

Comments
 (0)