---
title: "Secret Manager integrations"
slug: "k8s-k8suse-secret-manager"
updated: 2026-10-08T06:52:05Z
published: 2026-10-08T06:52:05Z
canonical: "guide.ncloud-docs.com/k8s-k8suse-secret-manager"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret Manager integrations

Available in VPC

In Ncloud Kubernetes Service, you can integrate and use secrets stored in [Secret Manager](https://guide.ncloud-docs.com/docs/en/secretmanager-overview). This feature is provided through [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) from Kubernetes and secrets-store-csi-driver-provider-ncp from Ncloud Kubernetes Service.

## Limitations

- Secret Manager is only available in the Korea and Japan regions.

## Requirements

- You must subscribe to Secret Manager.
- If you use a Sub Account, the NCP_SECRETMANAGER_USER permission is required to view Secret Manager.

## Features

- You can mount secrets stored in Secret Manager to pods as volumes.
- When a secret stored in Secret Manager is rotated, the secret mounted to the pod can also be rotated automatically.
- You can sync secrets stored in Secret Manager with Kubernetes Secrets.

## Installation

To integrate with Secret Manager, you must install secrets-store-csi-driver and secrets-store-csi-driver-provider-ncp.

1. Install secrets-store-csi-driver using the following command.

```
$ helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
$ helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace kube-system
```
  - To use the secret rotation feature, add the `--set enableSecretRotation=true` setting.
  - To use the Kubernetes Secret sync feature, add the `--set syncSecret.enabled=true` setting.
2. Create the credentials for calling the Secret Manager API.

```
$ vi configure
ncloud_access_key_id=<ACCESS_KEY_ID>
ncloud_secret_access_key=<SECRET_ACESS_KEY>
secretmanager_api_url=<SecretManager API URL>
```
  - ncloud_access_key_id: Ncloud AcessKey
  - ncloud_secret_access_key: Ncloud SecretKey
  - secretmanager_api_url
    - Korea: https://ocapi-kr.ncloud.com/secretmanager/api/v1
    - Japan: https://ocapi-jp.ncloud.com/secretmanager/api/v1
3. Create the credentials as a Kubernetes Secret using the following command.

```
$ kubectl -n kube-system create secret generic ncp-secrets-store-credentials --from-file=./configure
```
4. Install secrets-store-csi-driver-provider-ncp for your region using the following command.

```
# Korea Region
$ kubectl --kubeconfig=$KUBE_CONFIG apply -f https://kr.object.ncloudstorage.com/nks-download/secrets-store-csi-driver-provider-ncp/pub/kr/v0.1.0/provider-ncp.yaml

# Japan Region
$ kubectl --kubeconfig=$KUBE_CONFIG apply -f https://kr.object.ncloudstorage.com/nks-download/secrets-store-csi-driver-provider-ncp/pub/jp/v0.1.0/provider-ncp.yaml
```
5. Check that the installed pods are running properly using the following command.

```
$ kubectl -n kube-system get po -l app.kubernetes.io/instance=csi-secrets-store
$ kubectl -n kube-system get po -l app=secrets-store-csi-driver-provider-ncp
```

## Usage

### Define SecretProviderClass

You can use secrets integrated with Secret Manager by defining a SecretProviderClass.

```
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: my-namespace
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        path: "my-secret.txt"
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "id"
        path: "id.txt"
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "password"
        path: "password.txt"
  secretObjects:
  - secretName: my-secret
    type: Opaque
    data:
    - objectName: my-secret.txt
      key: my-key
```

- provider: ncp
- objects: Defines the secrets to mount as files.
  - objectName: Name of the secret created in SecretManager.
  - objectType: secretmanager
  - path: Name of the file to be mounted to the pod.
  - secretKey (optional): Uses only the value of the specified key from the secret stored in SecretManager. If not defined, all key-value pairs stored in the secret are used in JSON format.
- secretObjects (optional): Set this to sync with a Kubernetes Secret.
  - secretName: Name of the Kubernetes Secret to be created.
  - data.objectName: Name of the file mounted to the pod (path).
  - data.key: Key name in the data of the created Secret.

### Configure pod mounts

You can use it by setting secretProviderClass in the pod's volumes.

```
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"
```

### Check secret mount status

You can check the status of the secrets currently mounted to a pod by querying SecretProviderClassPodStatus.

```
$ kubectl get secretproviderclasspodstatuses <pod_name>-<namespace>-<secretproviderclass_name> -o yaml
...
status:
  mounted: true
  objects:
  - id: secretmanager/my-secret
    version: "1"
  podName: my-pod
  secretProviderClassName: my-secret
  targetPath: /var/lib/kubelet/pods/1d401b1a-9a16-4335-b015-59e11e87b349/volumes/kubernetes.io~csi/my-secret/mount
```

### Use secret rotation

To rotate secrets, see [Secret rotation settings](https://guide.ncloud-docs.com/docs/en/secretmanager-rotate-action) in Secret Manager. When a secret in Secret Manager is rotated, the file where the secret is mounted is also synced automatically. This feature is provided as an alpha feature of secrets-store-csi-driver. Before using it, see the [official guide](https://secrets-store-csi-driver.sigs.k8s.io/topics/secret-auto-rotation).