You signed in with another tab or window.Reload to refresh your session.You signed out in another tab or window.Reload to refresh your session.You switched accounts on another tab or window.Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _docs/kb/articles/external-secrets-operators-aws-secrets-manager.md
+39-8Lines changed: 39 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,9 @@ This article explains how to install and use the [External Secrets Operator](htt
26
26
27
27
###Installation
28
28
29
-
First you need to install the External Secrets Operator. To do that, we are going to add an Application to your Git Source. Create a file in your Git Source called`external-secrets-operator.yaml` and use the below application to install. Once done, save, commit, and push to your repo.
29
+
First, you need to install the External Secrets Operator. To do that, we are going to add an Application to your Git Source. Create a file in your Git Source called`external-secrets-operator.yaml` and use the below application to install. Once done, save, commit, and push to your repo
30
+
31
+
{% raw %}
30
32
31
33
```yaml
32
34
apiVersion:argoproj.io/v1alpha1
@@ -60,13 +62,17 @@ spec:
60
62
-RespectIgnoreDifferences=false
61
63
```
62
64
65
+
{% endraw %}
66
+
63
67
You should now see this application when viewing the [application dashboard](https://g.codefresh.io/2.0/applications-dashboard/list)
64
68
65
69
### Usage
66
70
67
71
#### AWS Set Up
68
72
69
-
Now that we have the External Secrets Operator Installed, Now we can set up the Secret Store. First we need to create an IAM Role for Service Accounts (IRSA) that is going to be used to access the secrets. First you need to create a role based on the [EKS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). Below is the minium permissions needed to access the secrets that starts with`testing/`. You can edit the Resource section that suites your needs.
73
+
Now that we have the External Secrets Operator Installed, we can set up the Secret Store. First, we need to create an IAM Role for Service Accounts (IRSA) that is going to be used to access the secrets. You will need to create a role based on the [EKS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). Below are the minimum permissions needed to access the secrets that start with`testing/`. You can edit the Resource section that suits your needs
74
+
75
+
{% raw %}
70
76
71
77
```json
72
78
{
@@ -88,22 +94,29 @@ Now that we have the External Secrets Operator Installed, Now we can set up the
88
94
}
89
95
```
90
96
91
-
Once the IRSA is created, create a secret in AWS Secrets Manager (region us-east-1 in this example). Use the "Other type of Secret" when creating the secret. Add your key value pairs that you want. When naming, use the prefix of `testing/` for this example. The rest of the options, use the defaults.
97
+
{% endraw %}
98
+
99
+
Once the IRSA is created, create a secret in AWS Secrets Manager (region us-east-1 in this example). Use the "Other type of Secret" when creating the secret. Add the key-value pairs that you want. When naming, use the prefix of `testing/` for this example. The rest of the options, use the defaults.
92
100
93
101
#### Adding Secrets to Git Source
94
102
95
-
Now that we have everything set up on AWS, time to create a Service Account, Secret Store, and External Secret. First create a Directory in your Git Source Repo thats outside of the path for the Git Source. In this example my Git Source path is `gitops/argocd` but my files will be located in `gitops/test-applications`.
103
+
Now that we have everything set up on AWS, time to create a Service Account, Secret Store, and External Secret. First, create a Directory in your Git Source Repo that's outside of the path for the Git Source. In this example, my Git Source path is `gitops/argocd` but my files will be located in `gitops/test-applications`.
104
+
105
+
{% raw %}
96
106
97
107
```shell
98
108
├── gitops
99
109
│ ├── argocd
100
110
│ │ └── external-secrets-operator.yaml
101
111
│ ├── test-applications
102
-
103
112
```
104
113
114
+
{% endraw %}
115
+
105
116
Inside test-applications directory create a file called `secret-store.yaml`. Here we will create a Service Account and Secret Store config. The SecretStore will allow us to access AWS Secrets Manager and use the Service Account to make the API Calls to AWS.
106
117
118
+
{% raw %}
119
+
107
120
```yaml
108
121
apiVersion: external-secrets.io/v1beta1
109
122
kind: SecretStore
@@ -127,8 +140,12 @@ metadata:
127
140
name: aws-secret-store
128
141
```
129
142
143
+
{% endraw %}
144
+
130
145
Now create another file called `external-secret.yaml` in the testing-applications directory. This is where we are going to use to generate a kubernets secret. We will define a refresh interval so the screte is up to date in the cluster, how to access the secret via the Secret Store, the name of the scret in AWS Secret Manager, and what to name the k8s secret kind once retrieved.
131
146
147
+
{% raw %}
148
+
132
149
```yaml
133
150
apiVersion: external-secrets.io/v1beta1
134
151
kind: ExternalSecret
@@ -150,10 +167,14 @@ spec:
150
167
metadataPolicy: None
151
168
```
152
169
170
+
{% endraw %}
171
+
153
172
#### Adding Application for Example
154
173
155
174
Now we have the information, we are going to add another application under `gitops/argocd` to simulate an application that needs a secret. Create a file called `test-application.yaml` with the following values.
156
175
176
+
{% raw %}
177
+
157
178
```yaml
158
179
apiVersion: argoproj.io/v1alpha1
159
180
kind: Application
@@ -188,17 +209,25 @@ spec:
188
209
- RespectIgnoreDifferences=false
189
210
```
190
211
191
-
This application is going to deploy in the `testing` namespace. so all the items before are name spaced spacific and can be reused in different namespace. Now save, commit and push these items to your git repo.
212
+
{% endraw %}
213
+
214
+
This application is going to be deployed in the `testing` namespace. All the items before are name-spaced specific and can be reused in different namespaces. Now save, commit, and push these items to your git repo.
192
215
193
216
#### Verification
194
217
195
-
Now you should see the Application in your the dashboard. You should see a k8s secret that has all the key value pairs that you created in AWS Secrets Manager. You can run the following command to verify its there.
218
+
Now you should see the Application in your dashboard. You should see a k8s secret that has all the key-value pairs that you created in AWS Secrets Manager. You can run the following command to verify it's there.
219
+
220
+
{% raw %}
196
221
197
222
```shell
198
223
kubectl get secrets -n testing my-secret -o yaml
199
224
```
200
225
201
-
You should see something similiar below for your secret.
226
+
{% endraw %}
227
+
228
+
You should see something similar below for your secret.
