1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00
External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.
Find a file
Lee Wei add9c81932
chore: refactor parameterstore unit test (#164)
* new parameterstoreTestCase struct
* remove swp files
* ignore vim swp
* refactor TestGetSecretMap
* refactor TestGetSecret
* add api error test
* fix test case
2021-05-28 07:17:54 +02:00
.github ci: add helm.docs target to helm generate 2021-05-27 13:36:08 -05:00
apis add provider for gcp 2021-05-27 11:43:34 +02:00
assets Tidy image 2021-02-10 15:29:46 +01:00
deploy ci: add helm.docs target to helm generate 2021-05-27 13:36:08 -05:00
design Move crd spec to directory 2021-04-28 10:33:09 -05:00
docs Add documentation for gcpsm 2021-05-27 11:43:34 +02:00
e2e feat: add basic e2e test 2021-04-25 15:44:15 +02:00
hack fix: template data should be string, fix update mechanics 2021-05-20 08:46:22 +02:00
pkg chore: refactor parameterstore unit test (#164) 2021-05-28 07:17:54 +02:00
.editorconfig cleanup: add lint and editorconfig 2020-12-21 14:38:48 -05:00
.gitignore chore: refactor parameterstore unit test (#164) 2021-05-28 07:17:54 +02:00
.golangci.yaml Draft: feat: implement template (#69) 2021-04-23 08:22:23 +02:00
changelog.json feat: helm release workflow 2021-05-03 22:12:39 +02:00
CNAME Create CNAME 2021-03-05 18:26:07 +01:00
Dockerfile Improve primary CI pipeline and refactor Makefile 2021-02-25 05:01:57 -05:00
go.mod Fix merge conflicts to add GCP secret manager 2021-05-27 11:43:34 +02:00
go.sum add provider for gcp 2021-05-27 11:43:34 +02:00
LICENSE Move crd spec to directory 2021-04-28 10:33:09 -05:00
main.go Cleanup and remove kustomize manifests in favor of Helm chart 2021-04-08 13:56:11 -05:00
Makefile ci: add helm.docs target to helm generate 2021-05-27 13:36:08 -05:00
PROJECT convert to multi-api 2020-12-29 12:25:08 -05:00
README.md Update readme for gcpsm 2021-05-27 12:38:24 +02:00
RELEASE.md feat: helm release workflow 2021-05-03 22:12:39 +02:00
SECURITY.md feat: security policy & dependabot (#60) 2021-03-17 08:32:32 +01:00
tools.go Cleanup and remove kustomize manifests in favor of Helm chart 2021-04-08 13:56:11 -05:00

External Secrets


The External Secrets Operator reads information from a third party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

Multiple people and organizations are joining efforts to create a single External Secrets solution based on existing projects. If you are curious about the origins of this project, check out this issue and this PR.

Supported Backends

ESO installation with an AWS example

If you want to use Helm:

helm repo add external-secrets https://charts.external-secrets.io

helm install external-secrets \
   external-secrets/external-secrets \
    -n external-secrets \
    --create-namespace \
  # --set installCRDs=true

If you want to run it locally against the active Kubernetes cluster context:

git clone https://github.com/external-secrets/external-secrets.git
make crds.install
make run

Create a secret containing your AWS credentials:

echo -n 'KEYID' > ./access-key
echo -n 'SECRETKEY' > ./secret-access-key
kubectl create secret generic awssm-secret --from-file=./access-key  --from-file=./secret-access-key

Create a secret inside AWS Secret Manager with name my-json-secret with the following data:

{
  "name": {"first": "Tom", "last": "Anderson"},
  "friends": [
    {"first": "Dale", "last": "Murphy"},
    {"first": "Roger", "last": "Craig"},
    {"first": "Jane", "last": "Murphy"}
  ]
}

Apply the sample resources (omitting role and controller keys here, you should not omit them in production):

# secretstore.yaml
apiVersion: external-secrets.io/v1alpha1
kind: SecretStore
metadata:
  name: secretstore-sample
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-2
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: awssm-secret
            key: access-key
          secretAccessKeySecretRef:
            name: awssm-secret
            key: secret-access-key
# externalsecret.yaml
apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
  name: example
spec:
  refreshInterval: 1m
  secretStoreRef:
    name: secretstore-sample
    kind: SecretStore
  target:
    name: secret-to-be-created
    creationPolicy: Owner
  data:
  - secretKey: firstname
    remoteRef:
      key: my-json-secret
      property: name.first # Tom
  - secretKey: first_friend
    remoteRef:
      key: my-json-secret
      property: friends.1.first # Roger
kubectl apply -f secretstore.yaml
kubectl apply -f externalsecret.yaml

Running kubectl get secret secret-to-be-created should return a new secret created by the operator.

You can get one of its values with jsonpath (This should return Roger):

kubectl get secret secret-to-be-created   -o jsonpath='{.data.first_friend}' | base64 -d

We will add more documentation once we have the implementation for the different providers. You can find some here: https://external-secrets.io

Contributing

We welcome and encourage contributions to this project! Please read the Developer and Contribution process guides. Also make sure to check the Code of Conduct and adhere to its guidelines.

Kicked off by