Using External Secrets Operator

Use the External Secrets Operator add-on to set up synchronization with Kubernetes secrets that are stored in the VK Cloud Secret Manager.

1. Create a Kubernetes cluster of the latest version, if not done so already.
2. Install and configure kubectl, if not done so already.
3. Connect to the cluster via kubectl.
4. Install the External Secrets Manager add-on, if not done so already.
5. Enable API access, if not done so already.

In the VK Cloud Secret Manager, create a secret with the external-secret ID and arbitrary keys.

1. Create the external-secrets-operator namespace, if not done so already:

    
   kubectl create namespace external-secrets-operator

2. Create the password.yaml manifest that will store the password to access the VK Cloud Secret Manager:

    
   apiVersion: v1kind: Secretmetadata:  name: password  namespace: external-secrets-operatortype: Opaquedata:  password: <PASSWORD>

   Here, <PASSWORD> is your password from the VK Cloud management console in the base64 encoding.

3. Apply the manifest in the cluster:

    
   kubectl apply -f password.yaml

1. Go to your VK Cloud management console.

2. Click the username in the page header and select Project settings.

3. Go to the API access tab and keep note of the following values:

   • Project ID;
   • User Domain Name;
   • Username.

4. Create the secretstore.yaml manifest — an object of the SecretStore type that describes how to connect to the VK Cloud Secret Manager:

    
   apiVersion: external-secrets.io/v1kind: SecretStoremetadata:  name: secret-store  namespace: external-secrets-operatorspec:  provider:    vk:      projectID: <PROJECT_ID>      url: <AUTH_URL>      auth:        domain: <USER_DOMAIN_NAME>        username: <USERNAME>        password:          key: password          name: password

   Here:

   • <PROJECT_ID>, <USER_DOMAIN_NAME>, and <USERNAME> are the values from the project settings.
   • <AUTH_URL> is an address depending on your region:
     • https://msk.cloud.vk.com for the Moscow region
     • https://kz.cloud.vk.com for the Kazakhstan region

5. Apply the manifest in the cluster:

    
   kubectl apply -f secretstore.yaml

1. Create the externalsecret.yaml manifest — an object of the ExternalSecret type that describes what SecretStore to load the secret from and how to update it:

    
   apiVersion: external-secrets.io/v1kind: ExternalSecretmetadata:  name: external-secret  namespace: external-secrets-operatorspec:  refreshInterval: 5m  secretStoreRef:    name: secret-store    kind: SecretStore  target:    name: external-secret    creationPolicy: Owner  data:    - secretKey: <KEY_NAME_IN_SECRET>      remoteRef:        key: <SECRET_ID>        property: <SECRET_KEY>

   Здесь:

   • <KEY_NAME_IN_SECRET> is the name of the key in the Kubernetes secret. Example: password.
   • <SECRET_ID> is the ID of the secret that you created earlier in the VK Cloud Secret Manager.
   • <SECRET_KEY> is the key in the secret from the VK Cloud Secret Manager the value of which you want to synchronize with the Kubernetes secret.

   For example, the VK Cloud Secret Manager has a secret with the external-secret ID and the following pairs of values: key1: value1, key2: value2, key3: value3. If you want to set up the Kubernetes secret to synchronize the value of value2, use key2 in the property field:

    
   key: external-secretproperty: key2

2. Apply the manifest in the cluster:

    
   kubectl apply -f externalsecret.yaml

This will create a new object of the Secret type named external-secret in Kubernetes. The add-on will check the value of the specified field of the secret in the VK Cloud Secret Manager every five minutes. If the value changes, the add-on will automatically update it in the Kubernetes secret.

1. Create the externalsecretall.yaml manifest that will synchronize all pairs of values from the secret that you created in the VK Cloud Secret Manager:

    
   apiVersion: external-secrets.io/v1kind: ExternalSecretmetadata:  name: external-secret-all  namespace: external-secrets-operatorspec:  refreshInterval: 5m  secretStoreRef:    name: secret-store    kind: SecretStore  target:    name: external-secret-all    creationPolicy: Owner  dataFrom:    - extract:        key: <SECRET_ID>

2. Apply the manifest in the cluster:

    
   kubectl apply -f externalsecretall.yaml

This will create a new object of the Secret type named external-secret-all in Kubernetes. The add-on will check all values of the secret in the VK Cloud Secret Manager every five minutes. If the values change, the add-on will automatically update them in the Kubernetes secret.

1. Verify that the External Secrets Operator add-on correctly synchronizes secrets by using the command:

    
   kubectl -n external-secrets-operator get secret

   The command output must have the external-secret and external-secret-all secrets you created earlier:

    
   NAME                       TYPE     DATA    AGEexternal-secret            Opaque   1       ...external-secret-all        Opaque   2       ...external-secrets-webhook   Opaque   4       ...password                   Opaque   1       ...

2. View the contents of the secrets:

    
   kubectl -n external-secrets-operator get secret external-secret -o yamlkubectl -n external-secrets-operator get secret external-secret-all -o yaml

A running cluster consumes computing resources and is charged accordingly. If you no longer need the Kubernetes resources you created to test the External Secrets Operator, delete them:

1. Delete the external-secrets-operator namespace and the resources associated with it:

    
   kubectl delete namespace external-secrets-operator

2. Stop the cluster you created to use it later or delete it permanently.