---
title: "Secret Manager integration examples"
slug: "secret-manager-use-example"
updated: 2026-10-08T06:52:19Z
published: 2026-10-08T06:52:19Z
canonical: "guide.ncloud-docs.com/secret-manager-use-example"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret Manager integration examples

Available in VPC

In Ncloud Kubernetes Service, you can use secrets by integrating with Secret Manager.

## Create a secret in Secret Manager

See the [Secret Manager user guide](https://guide.ncloud-docs.com/docs/en/secretmanager-use) to create a secret named my-secret and register values with id and password as keys.

## Mount and use the entire secret registered in Secret Manager

1. Create a SecretProviderClass.

```
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: default
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        path: "my-secret.txt"
```

1. Create a pod that mounts the SecretProviderClass.

```
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: default
spec:
  containers:
  - name: my-pod
    command: [ "sleep", "1000000" ]
    image: busybox
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: "/var/secrets"
        name: my-secret
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"
```

1. Access the pod and check that the secret is mounted properly.

```
$ kubectl exec my-pod -- ls /var/secrets
my-secret.txt

$ kubectl exec my-pod -- cat /var/secrets/my-secret.txt
{"id": "my-id", "password": "my-password"}
```

## Mount specific keys of a secret registered in Secret Manager

1. Create a SecretProviderClass.

```
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: default
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "id"
        path: "id.txt"
      - objectName: "my-secret"
        objectType: "secretmanager"
        secretKey: "password"
        path: "password.txt"
```

1. Create a pod that mounts the SecretProviderClass.

```
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: default
spec:
  containers:
  - name: my-pod
    command: [ "sleep", "1000000" ]
    image: busybox
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: "/var/secrets"
        name: my-secret
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"
```

1. Access the pod and check that the secret is mounted properly.

```
$ kubectl exec my-pod -- ls /var/secrets
id.txt
password.txt

$ kubectl exec my-pod -- cat /var/secrets/id.txt
my-id

$ kubectl exec my-pod -- cat /var/secrets/password.txt
my-password
```

## Sync a secret registered in Secret Manager with a Kubernetes Secret

To sync a secret registered in Secret Manager with a Kubernetes Secret, the secret must be mounted to a pod.

1. Create a SecretProviderClass.

```
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-secret
  namespace: default
spec:
  provider: ncp
  parameters:
    objects: |
      - objectName: "my-secret"
        objectType: "secretmanager"
        path: "my-secret.txt"
  secretObjects:
  - secretName: my-secret
    type: Opaque
    data:
    - objectName: my-secret.txt
      key: my-key
```

1. Create a pod that mounts the SecretProviderClass.

```
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: default
spec:
  containers:
  - name: my-pod
    command: [ "sleep", "1000000" ]
    image: busybox
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: "/var/secrets"
        name: my-secret
  volumes:
  - name: my-secret
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-secret"
```

1. Check that the Kubernetes Secret has been created properly.

```
$ kubectl get secret my-secret -o yaml

apiVersion: v1
data:
  my-key: eyJpZCI6ICJteS1pZCIsICJwYXNzd29yZCI6ICJteS1wYXNzd29yZCJ9
kind: Secret
metadata:
  labels:
    secrets-store.csi.k8s.io/managed: "true"
  name: my-secret
  namespace: default
  ownerReferences:
  - apiVersion: secrets-store.csi.x-k8s.io/v1
    kind: SecretProviderClassPodStatus
    name: my-pod-default-my-secret
type: Opaque
```