|
|
@@ -9,10 +9,10 @@
|
|
|
|
|
|
|
|
|
|
|
|
- <link rel="prev" href="../fake/">
|
|
|
+ <link rel="prev" href="../hashicorp-vault/">
|
|
|
|
|
|
|
|
|
- <link rel="next" href="../senhasegura-dsm/">
|
|
|
+ <link rel="next" href="../ibm-secrets-manager/">
|
|
|
|
|
|
<link rel="icon" href="../../assets/images/favicon.png">
|
|
|
<meta name="generator" content="mkdocs-1.4.3, mkdocs-material-9.1.9">
|
|
|
@@ -1432,8 +1432,8 @@
|
|
|
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
- <a href="../ibm-secrets-manager/" class="md-nav__link">
|
|
|
- IBM Secrets Manager
|
|
|
+ <a href="../hashicorp-vault/" class="md-nav__link">
|
|
|
+ HashiCorp Vault
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
@@ -1444,10 +1444,135 @@
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <li class="md-nav__item md-nav__item--active">
|
|
|
+
|
|
|
+ <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <label class="md-nav__link md-nav__link--active" for="__toc">
|
|
|
+ Kubernetes
|
|
|
+ <span class="md-nav__icon md-icon"></span>
|
|
|
+ </label>
|
|
|
+
|
|
|
+ <a href="./" class="md-nav__link md-nav__link--active">
|
|
|
+ Kubernetes
|
|
|
+ </a>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <label class="md-nav__title" for="__toc">
|
|
|
+ <span class="md-nav__icon md-icon"></span>
|
|
|
+ Table of contents
|
|
|
+ </label>
|
|
|
+ <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#external-secret-spec" class="md-nav__link">
|
|
|
+ External Secret Spec
|
|
|
+ </a>
|
|
|
+
|
|
|
+ <nav class="md-nav" aria-label="External Secret Spec">
|
|
|
+ <ul class="md-nav__list">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#find-by-tag-name" class="md-nav__link">
|
|
|
+ find by tag & name
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ </ul>
|
|
|
+ </nav>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#target-api-server-configuration" class="md-nav__link">
|
|
|
+ Target API-Server Configuration
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#authentication" class="md-nav__link">
|
|
|
+ Authentication
|
|
|
+ </a>
|
|
|
+
|
|
|
+ <nav class="md-nav" aria-label="Authentication">
|
|
|
+ <ul class="md-nav__list">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#authenticating-with-bearertoken" class="md-nav__link">
|
|
|
+ Authenticating with BearerToken
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#authenticating-with-serviceaccount" class="md-nav__link">
|
|
|
+ Authenticating with ServiceAccount
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#authenticating-with-client-certificates" class="md-nav__link">
|
|
|
+ Authenticating with Client Certificates
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ </ul>
|
|
|
+ </nav>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#pushsecret" class="md-nav__link">
|
|
|
+ PushSecret
|
|
|
+ </a>
|
|
|
+
|
|
|
+ <nav class="md-nav" aria-label="PushSecret">
|
|
|
+ <ul class="md-nav__list">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#implementation-considerations" class="md-nav__link">
|
|
|
+ Implementation Considerations
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ </ul>
|
|
|
+ </nav>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ </ul>
|
|
|
+
|
|
|
+</nav>
|
|
|
+
|
|
|
+ </li>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
- <a href="../akeyless/" class="md-nav__link">
|
|
|
- Akeyless
|
|
|
+ <a href="../ibm-secrets-manager/" class="md-nav__link">
|
|
|
+ IBM Secrets Manager
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
@@ -1460,8 +1585,8 @@
|
|
|
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
- <a href="../hashicorp-vault/" class="md-nav__link">
|
|
|
- HashiCorp Vault
|
|
|
+ <a href="../akeyless/" class="md-nav__link">
|
|
|
+ Akeyless
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
@@ -1584,111 +1709,6 @@
|
|
|
|
|
|
|
|
|
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
- <li class="md-nav__item md-nav__item--active">
|
|
|
-
|
|
|
- <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
- <label class="md-nav__link md-nav__link--active" for="__toc">
|
|
|
- Kubernetes
|
|
|
- <span class="md-nav__icon md-icon"></span>
|
|
|
- </label>
|
|
|
-
|
|
|
- <a href="./" class="md-nav__link md-nav__link--active">
|
|
|
- Kubernetes
|
|
|
- </a>
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
- <label class="md-nav__title" for="__toc">
|
|
|
- <span class="md-nav__icon md-icon"></span>
|
|
|
- Table of contents
|
|
|
- </label>
|
|
|
- <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#external-secret-spec" class="md-nav__link">
|
|
|
- External Secret Spec
|
|
|
- </a>
|
|
|
-
|
|
|
- <nav class="md-nav" aria-label="External Secret Spec">
|
|
|
- <ul class="md-nav__list">
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#find-by-tag-name" class="md-nav__link">
|
|
|
- find by tag & name
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
- </nav>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#target-api-server-configuration" class="md-nav__link">
|
|
|
- Target API-Server Configuration
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#authentication" class="md-nav__link">
|
|
|
- Authentication
|
|
|
- </a>
|
|
|
-
|
|
|
- <nav class="md-nav" aria-label="Authentication">
|
|
|
- <ul class="md-nav__list">
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#authenticating-with-bearertoken" class="md-nav__link">
|
|
|
- Authenticating with BearerToken
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#authenticating-with-serviceaccount" class="md-nav__link">
|
|
|
- Authenticating with ServiceAccount
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#authenticating-with-client-certificates" class="md-nav__link">
|
|
|
- Authenticating with Client Certificates
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
- </nav>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
-
|
|
|
-</nav>
|
|
|
-
|
|
|
- </li>
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
<a href="../senhasegura-dsm/" class="md-nav__link">
|
|
|
@@ -2180,6 +2200,26 @@
|
|
|
</ul>
|
|
|
</nav>
|
|
|
|
|
|
+</li>
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#pushsecret" class="md-nav__link">
|
|
|
+ PushSecret
|
|
|
+ </a>
|
|
|
+
|
|
|
+ <nav class="md-nav" aria-label="PushSecret">
|
|
|
+ <ul class="md-nav__list">
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="#implementation-considerations" class="md-nav__link">
|
|
|
+ Implementation Considerations
|
|
|
+ </a>
|
|
|
+
|
|
|
+</li>
|
|
|
+
|
|
|
+ </ul>
|
|
|
+ </nav>
|
|
|
+
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
@@ -2232,20 +2272,20 @@
|
|
|
<span class="w"> </span><span class="c1"># metadataPolicy to fetch all the labels and annotations in JSON format</span>
|
|
|
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">secretKey</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">tags</span>
|
|
|
<span class="w"> </span><span class="nt">remoteRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">metadataPolicy</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Fetch</span><span class="w"> </span>
|
|
|
+<span class="w"> </span><span class="nt">metadataPolicy</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Fetch</span>
|
|
|
<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">database-credentials</span>
|
|
|
|
|
|
<span class="w"> </span><span class="c1"># metadataPolicy to fetch all the labels in JSON format</span>
|
|
|
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">secretKey</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">labels</span>
|
|
|
<span class="w"> </span><span class="nt">remoteRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">metadataPolicy</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Fetch</span><span class="w"> </span>
|
|
|
+<span class="w"> </span><span class="nt">metadataPolicy</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Fetch</span>
|
|
|
<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">database-credentials</span>
|
|
|
<span class="w"> </span><span class="nt">property</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">labels</span>
|
|
|
|
|
|
<span class="w"> </span><span class="c1"># metadataPolicy to fetch a specific label (dev) from the source secret</span>
|
|
|
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">secretKey</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">developer</span>
|
|
|
<span class="w"> </span><span class="nt">remoteRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">metadataPolicy</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Fetch</span><span class="w"> </span>
|
|
|
+<span class="w"> </span><span class="nt">metadataPolicy</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Fetch</span>
|
|
|
<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">database-credentials</span>
|
|
|
<span class="w"> </span><span class="nt">property</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">labels.dev</span>
|
|
|
</code></pre></div>
|
|
|
@@ -2392,6 +2432,78 @@ You may also define it inline as base64 encoded value using the <code>caBundle</
|
|
|
<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="s">"tls-secret"</span>
|
|
|
<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="s">"tls.key"</span>
|
|
|
</code></pre></div>
|
|
|
+<h3 id="pushsecret">PushSecret</h3>
|
|
|
+<p>The PushSecret functionality facilitates the replication of a Kubernetes Secret from one namespace or cluster to another. This feature proves useful in scenarios where you need to share sensitive information, such as credentials or configuration data, across different parts of your infrastructure.</p>
|
|
|
+<p>To configure the PushSecret resource, you need to specify the following parameters:</p>
|
|
|
+<ul>
|
|
|
+<li>
|
|
|
+<p><strong>Selector</strong>: Specify the selector that identifies the source Secret to be replicated. This selector allows you to target the specific Secret you want to share.</p>
|
|
|
+</li>
|
|
|
+<li>
|
|
|
+<p><strong>SecretKey</strong>: Set the SecretKey parameter to indicate the key within the source Secret that you want to replicate. This ensures that only the relevant information is shared.</p>
|
|
|
+</li>
|
|
|
+<li>
|
|
|
+<p><strong>RemoteRef.Property</strong>: In addition to the above parameters, the Kubernetes provider requires you to set the <code>remoteRef.property</code> field. This field specifies the key of the remote Secret resource where the replicated value should be stored.</p>
|
|
|
+</li>
|
|
|
+</ul>
|
|
|
+<p>Here's an example:</p>
|
|
|
+<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1alpha1</span>
|
|
|
+<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">PushSecret</span>
|
|
|
+<span class="nt">metadata</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">example</span>
|
|
|
+<span class="nt">spec</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">refreshInterval</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">10s</span>
|
|
|
+<span class="w"> </span><span class="nt">secretStoreRefs</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">k8s-store-remote-ns</span>
|
|
|
+<span class="w"> </span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
|
|
|
+<span class="w"> </span><span class="nt">selector</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">secret</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">pokedex-credentials</span>
|
|
|
+<span class="w"> </span><span class="nt">data</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">match</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">secretKey</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">best-pokemon</span>
|
|
|
+<span class="w"> </span><span class="nt">remoteRef</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">remoteKey</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">remote-best-pokemon</span>
|
|
|
+<span class="w"> </span><span class="nt">property</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">best-pokemon</span>
|
|
|
+</code></pre></div>
|
|
|
+<p>To utilize the PushSecret feature effectively, the referenced <code>SecretStore</code> requires specific permissions on the target cluster. In particular it requires <code>create</code>, <code>read</code>, <code>update</code> and <code>delete</code> permissions on the Secret resource:</p>
|
|
|
+<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">rbac.authorization.k8s.io/v1</span>
|
|
|
+<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Role</span>
|
|
|
+<span class="nt">metadata</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">remote</span>
|
|
|
+<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eso-store-push-role</span>
|
|
|
+<span class="nt">rules</span><span class="p">:</span>
|
|
|
+<span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">apiGroups</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="s">""</span><span class="p p-Indicator">]</span>
|
|
|
+<span class="w"> </span><span class="nt">resources</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">secrets</span>
|
|
|
+<span class="w"> </span><span class="nt">verbs</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">get</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">list</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">watch</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">create</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">update</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">patch</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">delete</span>
|
|
|
+<span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">apiGroups</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">authorization.k8s.io</span>
|
|
|
+<span class="w"> </span><span class="nt">resources</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">selfsubjectrulesreviews</span>
|
|
|
+<span class="w"> </span><span class="nt">verbs</span><span class="p">:</span>
|
|
|
+<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">create</span>
|
|
|
+</code></pre></div>
|
|
|
+<h4 id="implementation-considerations">Implementation Considerations</h4>
|
|
|
+<p>When utilizing the PushSecret feature and configuring the permissions for the SecretStore, consider the following:</p>
|
|
|
+<ul>
|
|
|
+<li>
|
|
|
+<p><strong>RBAC Configuration</strong>: Ensure that the Role-Based Access Control (RBAC) configuration for the SecretStore grants the appropriate permissions for creating, reading, and updating resources in the target cluster.</p>
|
|
|
+</li>
|
|
|
+<li>
|
|
|
+<p><strong>Least Privilege Principle</strong>: Adhere to the principle of least privilege when assigning permissions to the SecretStore. Only provide the minimum required permissions to accomplish the desired synchronization between Secrets.</p>
|
|
|
+</li>
|
|
|
+<li>
|
|
|
+<p><strong>Namespace or Cluster Scope</strong>: Depending on your specific requirements, configure the SecretStore to operate at the desired scope, whether it is limited to a specific namespace or encompasses the entire cluster. Consider the security and access control implications of your chosen scope.</p>
|
|
|
+</li>
|
|
|
+</ul>
|
|
|
|
|
|
|
|
|
|