Secret Manager integration examples

Available in VPC

In Ncloud Kubernetes Service, you can use secrets by integrating with Secret Manager.

Create a secret in Secret Manager

See the Secret Manager user guide to create a secret named my-secret and register values with id and password as keys.

Mount and use the entire secret registered in Secret Manager

1. Create a SecretProviderClass.

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: default
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        path: "my-secret.txt"

2. Create a pod that mounts the SecretProviderClass.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: default
spec:
  containers:
  - name: my-pod
    command: [ "sleep", "1000000" ]
    image: busybox
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: "/var/secrets"
        name: my-secret
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"

3. Access the pod and check that the secret is mounted properly.

$ kubectl exec my-pod -- ls /var/secrets
my-secret.txt

$ kubectl exec my-pod -- cat /var/secrets/my-secret.txt
{"id": "my-id", "password": "my-password"}

Mount specific keys of a secret registered in Secret Manager

1. Create a SecretProviderClass.

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: default
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "id"
        path: "id.txt"
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "password"
        path: "password.txt"

2. Create a pod that mounts the SecretProviderClass.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: default
spec:
  containers:
  - name: my-pod
    command: [ "sleep", "1000000" ]
    image: busybox
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: "/var/secrets"
        name: my-secret
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"

3. Access the pod and check that the secret is mounted properly.

$ kubectl exec my-pod -- ls /var/secrets
id.txt
password.txt

$ kubectl exec my-pod -- cat /var/secrets/id.txt
my-id

$ kubectl exec my-pod -- cat /var/secrets/password.txt
my-password

Sync a secret registered in Secret Manager with a Kubernetes Secret

To sync a secret registered in Secret Manager with a Kubernetes Secret, the secret must be mounted to a pod.

1. Create a SecretProviderClass.

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: default
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        path: "my-secret.txt"
  secretObjects:
  - secretName: my-secret
    type: Opaque
    data:
    - objectName: my-secret.txt
      key: my-key

2. Create a pod that mounts the SecretProviderClass.

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: default
spec:
  containers:
  - name: my-pod
    command: [ "sleep", "1000000" ]
    image: busybox
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: "/var/secrets"
        name: my-secret
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"

3. Check that the Kubernetes Secret has been created properly.

$ kubectl get secret my-secret -o yaml

apiVersion: v1
data:
  my-key: eyJpZCI6ICJteS1pZCIsICJwYXNzd29yZCI6ICJteS1wYXNzd29yZCJ9
kind: Secret
metadata:
  labels:
    secrets-store.csi.k8s.io/managed: "true"
  name: my-secret
  namespace: default
  ownerReferences:
  - apiVersion: secrets-store.csi.x-k8s.io/v1
    kind: SecretProviderClassPodStatus
    name: my-pod-default-my-secret
type: Opaque