logic855
/
helm-external-secrets
réplica de https://github.com/external-secrets/external-secrets


			
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865
							

<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      <meta http-equiv="x-ua-compatible" content="ie=edge">
      
      
        <meta name="lang:clipboard.copy" content="Copy to clipboard">
      
        <meta name="lang:clipboard.copied" content="Copied to clipboard">
      
        <meta name="lang:search.language" content="en">
      
        <meta name="lang:search.pipeline.stopwords" content="True">
      
        <meta name="lang:search.pipeline.trimmer" content="True">
      
        <meta name="lang:search.result.none" content="No matching documents">
      
        <meta name="lang:search.result.one" content="1 matching document">
      
        <meta name="lang:search.result.other" content="# matching documents">
      
        <meta name="lang:search.tokenizer" content="[\s\-]+">
      
      <link rel="shortcut icon" href="../assets/images/favicon.png">
      <meta name="generator" content="mkdocs-1.0.4, mkdocs-material-4.6.0">
    
    
        <title>Multi Tenancy - External Secrets Operator</title>
      
    
      <link rel="stylesheet" href="../assets/stylesheets/application.1b62728e.css">
      
      
      <script src="../assets/javascripts/modernizr.268332fc.js"></script>
    
    
        <link href="https://fonts.gstatic.com" rel="preconnect" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,400i,700%7CRoboto+Mono&display=fallback">
        <style>body,input{font-family:"Roboto","Helvetica Neue",Helvetica,Arial,sans-serif}code,kbd,pre{font-family:"Roboto Mono","Courier New",Courier,monospace}</style>
      
    
    <link rel="stylesheet" href="../assets/fonts/material-icons.css">
    
    
  </head>
  
    <body dir="ltr">
  
    <svg class="md-svg">
      <defs>
        
        
          <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448" viewBox="0 0 416 448" id="__github"><path fill="currentColor" d="M160 304q0 10-3.125 20.5t-10.75 19T128 352t-18.125-8.5-10.75-19T96 304t3.125-20.5 10.75-19T128 256t18.125 8.5 10.75 19T160 304zm160 0q0 10-3.125 20.5t-10.75 19T288 352t-18.125-8.5-10.75-19T256 304t3.125-20.5 10.75-19T288 256t18.125 8.5 10.75 19T320 304zm40 0q0-30-17.25-51T296 232q-10.25 0-48.75 5.25Q229.5 240 208 240t-39.25-2.75Q130.75 232 120 232q-29.5 0-46.75 21T56 304q0 22 8 38.375t20.25 25.75 30.5 15 35 7.375 37.25 1.75h42q20.5 0 37.25-1.75t35-7.375 30.5-15 20.25-25.75T360 304zm56-44q0 51.75-15.25 82.75-9.5 19.25-26.375 33.25t-35.25 21.5-42.5 11.875-42.875 5.5T212 416q-19.5 0-35.5-.75t-36.875-3.125-38.125-7.5-34.25-12.875T37 371.5t-21.5-28.75Q0 312 0 260q0-59.25 34-99-6.75-20.5-6.75-42.5 0-29 12.75-54.5 27 0 47.5 9.875t47.25 30.875Q171.5 96 212 96q37 0 70 8 26.25-20.5 46.75-30.25T376 64q12.75 25.5 12.75 54.5 0 21.75-6.75 42 34 40 34 99.5z"/></svg>
        
      </defs>
    </svg>
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" data-md-component="overlay" for="__drawer"></label>
    
      <a href="#shared-clustersecretstore" tabindex="1" class="md-skip">
        Skip to content
      </a>
    
    
      <header class="md-header" data-md-component="header">
  <nav class="md-header-nav md-grid">
    <div class="md-flex">
      <div class="md-flex__cell md-flex__cell--shrink">
        <a href=".." title="External Secrets Operator" class="md-header-nav__button md-logo">
          
            <i class="md-icon"></i>
          
        </a>
      </div>
      <div class="md-flex__cell md-flex__cell--shrink">
        <label class="md-icon md-icon--menu md-header-nav__button" for="__drawer"></label>
      </div>
      <div class="md-flex__cell md-flex__cell--stretch">
        <div class="md-flex__ellipsis md-header-nav__title" data-md-component="title">
          
            <span class="md-header-nav__topic">
              External Secrets Operator
            </span>
            <span class="md-header-nav__topic">
              
                Multi Tenancy
              
            </span>
          
        </div>
      </div>
      <div class="md-flex__cell md-flex__cell--shrink">
        
          <label class="md-icon md-icon--search md-header-nav__button" for="__search"></label>
          
<div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="query" data-md-state="active">
      <label class="md-icon md-search__icon" for="__search"></label>
      <button type="reset" class="md-icon md-search__icon" data-md-component="reset" tabindex="-1">
        &#xE5CD;
      </button>
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="result">
          <div class="md-search-result__meta">
            Type to start searching
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
        
      </div>
      
        <div class="md-flex__cell md-flex__cell--shrink">
          <div class="md-header-nav__source">
            

<a href="https://github.com/external-secrets/external-secrets/" title="Go to repository" class="md-source" data-md-source="github">
  
    <div class="md-source__icon">
      <svg viewBox="0 0 24 24" width="24" height="24">
        <use xlink:href="#__github" width="24" height="24"></use>
      </svg>
    </div>
  
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
          </div>
        </div>
      
    </div>
  </nav>
</header>
    
    <div class="md-container">
      
        
      <main class="md-main" role="main">
        <div class="md-main__inner md-grid" data-md-component="container">
          
            
              <div class="md-sidebar md-sidebar--primary" data-md-component="navigation">
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    <nav class="md-nav md-nav--primary" data-md-level="0">
  <label class="md-nav__title md-nav__title--site" for="__drawer">
    <a href=".." title="External Secrets Operator" class="md-nav__button md-logo">
      
        <i class="md-icon"></i>
      
    </a>
    External Secrets Operator
  </label>
  
    <div class="md-nav__source">
      

<a href="https://github.com/external-secrets/external-secrets/" title="Go to repository" class="md-source" data-md-source="github">
  
    <div class="md-source__icon">
      <svg viewBox="0 0 24 24" width="24" height="24">
        <use xlink:href="#__github" width="24" height="24"></use>
      </svg>
    </div>
  
  <div class="md-source__repository">
    External Secrets Operator
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
  <li class="md-nav__item">
    <a href=".." title="Introduction" class="md-nav__link">
      Introduction
    </a>
  </li>

    
  <li class="md-nav__item">
    <a href="../api-overview/" title="Overview" class="md-nav__link">
      Overview
    </a>
  </li>

    
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-3" type="checkbox" id="nav-3">
    
    <label class="md-nav__link" for="nav-3">
      API Types
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
      <label class="md-nav__title" for="nav-3">
        API Types
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../api-externalsecret/" title="ExternalSecret" class="md-nav__link">
      ExternalSecret
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../api-secretstore/" title="SecretStore" class="md-nav__link">
      SecretStore
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../api-clustersecretstore/" title="ClusterSecretStore" class="md-nav__link">
      ClusterSecretStore
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

    
  <li class="md-nav__item md-nav__item--active md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-4" type="checkbox" id="nav-4" checked>
    
    <label class="md-nav__link" for="nav-4">
      Guides
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
      <label class="md-nav__title" for="nav-4">
        Guides
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../guides-introduction/" title="Introduction" class="md-nav__link">
      Introduction
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../guides-getting-started/" title="Getting started" class="md-nav__link">
      Getting started
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../guides-templating/" title="Advanced Templating" class="md-nav__link">
      Advanced Templating
    </a>
  </li>

        
  <li class="md-nav__item md-nav__item--active">
    
    <input class="md-toggle md-nav__toggle" data-md-toggle="toc" type="checkbox" id="__toc">
    
    
      <label class="md-nav__link md-nav__link--active" for="__toc">
        Multi Tenancy
      </label>
    
    <a href="./" title="Multi Tenancy" class="md-nav__link md-nav__link--active">
      Multi Tenancy
    </a>
    
      
<nav class="md-nav md-nav--secondary">
  
  
    <label class="md-nav__title" for="__toc">Table of contents</label>
    <ul class="md-nav__list" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#shared-clustersecretstore" class="md-nav__link">
    Shared ClusterSecretStore
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#managed-secretstore-per-namespace" class="md-nav__link">
    Managed SecretStore per Namespace
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#eso-as-a-service" class="md-nav__link">
    ESO as a Service
  </a>
  
</li>
      
      
    </ul>
  
</nav>
    
  </li>

        
  <li class="md-nav__item">
    <a href="../guides-metrics/" title="Metrics" class="md-nav__link">
      Metrics
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

    
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-5" type="checkbox" id="nav-5">
    
    <label class="md-nav__link" for="nav-5">
      Provider
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
      <label class="md-nav__title" for="nav-5">
        Provider
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-5-1" type="checkbox" id="nav-5-1">
    
    <label class="md-nav__link" for="nav-5-1">
      AWS
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="2">
      <label class="md-nav__title" for="nav-5-1">
        AWS
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../provider-aws-secrets-manager/" title="Secrets Manager" class="md-nav__link">
      Secrets Manager
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../provider-aws-parameter-store/" title="Parameter Store" class="md-nav__link">
      Parameter Store
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

        
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-5-2" type="checkbox" id="nav-5-2">
    
    <label class="md-nav__link" for="nav-5-2">
      Azure
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="2">
      <label class="md-nav__title" for="nav-5-2">
        Azure
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../provider-azure-key-vault/" title="Key Vault" class="md-nav__link">
      Key Vault
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

        
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-5-3" type="checkbox" id="nav-5-3">
    
    <label class="md-nav__link" for="nav-5-3">
      Google
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="2">
      <label class="md-nav__title" for="nav-5-3">
        Google
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../provider-google-secrets-manager/" title="Secrets Manager" class="md-nav__link">
      Secrets Manager
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

        
  <li class="md-nav__item">
    <a href="../provider-hashicorp-vault/" title="HashiCorp Vault" class="md-nav__link">
      HashiCorp Vault
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

    
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-6" type="checkbox" id="nav-6">
    
    <label class="md-nav__link" for="nav-6">
      References
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
      <label class="md-nav__title" for="nav-6">
        References
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../spec/" title="API specification" class="md-nav__link">
      API specification
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

    
  <li class="md-nav__item md-nav__item--nested">
    
      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-7" type="checkbox" id="nav-7">
    
    <label class="md-nav__link" for="nav-7">
      Contributing
    </label>
    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
      <label class="md-nav__title" for="nav-7">
        Contributing
      </label>
      <ul class="md-nav__list" data-md-scrollfix>
        
        
  <li class="md-nav__item">
    <a href="../contributing-devguide/" title="Developer guide" class="md-nav__link">
      Developer guide
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../contributing-process/" title="Contributing Process" class="md-nav__link">
      Contributing Process
    </a>
  </li>

        
  <li class="md-nav__item">
    <a href="../contributing-coc/" title="Code of Conduct" class="md-nav__link">
      Code of Conduct
    </a>
  </li>

        
      </ul>
    </nav>
  </li>

    
  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              <div class="md-sidebar md-sidebar--secondary" data-md-component="toc">
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    
<nav class="md-nav md-nav--secondary">
  
  
    <label class="md-nav__title" for="__toc">Table of contents</label>
    <ul class="md-nav__list" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#shared-clustersecretstore" class="md-nav__link">
    Shared ClusterSecretStore
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#managed-secretstore-per-namespace" class="md-nav__link">
    Managed SecretStore per Namespace
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#eso-as-a-service" class="md-nav__link">
    ESO as a Service
  </a>
  
</li>
      
      
    </ul>
  
</nav>
                  </div>
                </div>
              </div>
            
          
          <div class="md-content">
            <article class="md-content__inner md-typeset">
              
                
                  <a href="https://github.com/external-secrets/external-secrets/edit/master/docs/guides-multi-tenancy.md" title="Edit this page" class="md-icon md-content__icon">&#xE3C9;</a>
                
                
                  <h1>Multi Tenancy</h1>
                
                <p>External Secrets Operator provides different modes of operation to fulfill
ogranizational needs. This guide outlines the flexibility of ESO and should give
you a first impression of how you can employ this operator in your organization.</p>
<p>For a multi-tenant deployment you should first examine your organizational
structure:</p>
<ol>
<li>what roles (i.e. <em>Application Developers</em>, <em>Cluster Admins</em>, ...) do you have
   in your organization,</li>
<li>what responsibilities do they have and</li>
<li>how does that map to Kubernetes RBAC roles.</li>
</ol>
<p>Further, you should examine how your external API provider manages access
control for your secrets. Can you limit access by secret names (e.g.
<code>db/dev/*</code>)? Or only on a bucket level? Please keep in mind that not all
external APIs provide fine-grained access management for secrets.</p>
<p><strong>Note:</strong> The following examples should <strong>not</strong> be considered as best practice
but rather as a example to show how to combine different mechanics and
techniques for tenant isolation.</p>
<h3 id="shared-clustersecretstore">Shared ClusterSecretStore</h3>
<p><img alt="Shared CSS" src="../pictures/diagrams-multi-tenancy-shared.png" /></p>
<p>A Cluster Administrator deploys a <code>ClusterSecretStore</code> (CSS) and manages access
to the external API. The CSS is shared by all tenants within the cluster.
Application Developers do reference it in a <code>ExternalSecret</code> but can not create
a ClusterSecretStores or SecretStores on their own. Now all application
developers have access to all the secrets. You probably want to limit access to
certain keys or prefixes that should be used. ESO does not provide a mechanic
to limit access to certain keys per namespace. More advanced validation should be
done with an Admission Webhook, e.g. with <a href="https://kyverno.io/">Kyverno</a> or
<a href="https://www.openpolicyagent.org/">Open Policy Agent</a>).</p>
<p>This setup suites well if you have one central bucket that contains all of your
secrets and your Cluster Administrators should manage access to it. This setup
is very simple but does not scale very well.</p>
<h3 id="managed-secretstore-per-namespace">Managed SecretStore per Namespace</h3>
<p><img alt="Shared CSS" src="../pictures/diagrams-multi-tenancy-managed-store.png" /></p>
<p>Cluster Administrators manage one or multipe <code>SecretStores</code> per Namespace. Each
SecretStore uses it's own <em>role</em> that limits access to a small set of keys. The
peculiarity of this is approach is, that <strong>access is actually managed by the
external API</strong> which provides the roles. The Cluster Administrator does just the
wiring. This approach may be desirable if you have an external entity - let's
call it <strong>Secret Administrator</strong> - that manages access and lifecycle of the
secrets.</p>
<h3 id="eso-as-a-service">ESO as a Service</h3>
<p><img alt="Shared CSS" src="../pictures/diagrams-multi-tenancy-self-service.png" /></p>
<p>Every namespace is self-contained. Application developers manage <code>SecretStore</code>,
<code>ExternalSecret</code> and secret infrastructure on their own. Cluster Administrators
<em>just</em> provide the External Secrets Operator as a service.</p>
<p>This makes sense if application developers should be completely autonomous while
a central team provides common services.</p>
                
                  
            </article>
          </div>
        </div>
      </main>
      
        
<footer class="md-footer">
  
    <div class="md-footer-nav">
      <nav class="md-footer-nav__inner md-grid">
        
          <a href="../guides-templating/" title="Advanced Templating" class="md-flex md-footer-nav__link md-footer-nav__link--prev" rel="prev">
            <div class="md-flex__cell md-flex__cell--shrink">
              <i class="md-icon md-icon--arrow-back md-footer-nav__button"></i>
            </div>
            <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title">
              <span class="md-flex__ellipsis">
                <span class="md-footer-nav__direction">
                  Previous
                </span>
                Advanced Templating
              </span>
            </div>
          </a>
        
        
          <a href="../guides-metrics/" title="Metrics" class="md-flex md-footer-nav__link md-footer-nav__link--next" rel="next">
            <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title">
              <span class="md-flex__ellipsis">
                <span class="md-footer-nav__direction">
                  Next
                </span>
                Metrics
              </span>
            </div>
            <div class="md-flex__cell md-flex__cell--shrink">
              <i class="md-icon md-icon--arrow-forward md-footer-nav__button"></i>
            </div>
          </a>
        
      </nav>
    </div>
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-footer-copyright">
        
        powered by
        <a href="https://www.mkdocs.org">MkDocs</a>
        and
        <a href="https://squidfunk.github.io/mkdocs-material/">
          Material for MkDocs</a>
      </div>
      
    </div>
  </div>
</footer>
      
    </div>
    
      <script src="../assets/javascripts/application.808e90bb.js"></script>
      
      <script>app.initialize({version:"1.0.4",url:{base:".."}})</script>
      
    
  </body>
</html>