External Secrets Operator: Generate secrets using a template

Kubernetes ExternalSecret

2 min read | by Jordi Prats

We can use the External Secrets Operator to retrieve secrets from some backend and push it into a vanilla Kubernetes Secrets to be consumed as usual as a key-value. Not all applications work in the same way so we might need to format it in a way that the application is able to consume it.

Let's take as an example the following ExternalSecret:

apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata:  name: vault-example spec:  refreshInterval: "15s"  secretStoreRef:  name: vault-backend  kind: SecretStore  data:  - secretKey: demo  remoteRef:  key: secret/demo  property: secret

We'll get a Secret that contains the data retrieved under the data.demo key:

$ kubectl get secret vault-example -o jsonpath='{.data}' {"demo":"czNjcjN0"}

We might need to use some other format under a different key name, for example:

sometingelse: "data retrieved from Vault is VALUE"

We can use spec.target.template for this:

apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata:  name: vault-example-with-template spec:  refreshInterval: "15s"  secretStoreRef:  name: vault-backend  kind: SecretStore  target:  template:  data:  somekey: |  somethingelse: "data retrieved from Vault is {{ .demo }}"  data:  - secretKey: demo  remoteRef:  key: secret/demo  property: secret

Applying this ExternalSecret we'll be able to see how it creates the Secret using the alternate key:

$ kubectl get secret vault-example-with-template -o jsonpath='{.data}' {"somekey":"cHV0YSBFc3BhbnlhIGkgbGEgcHV0YSBtYXJlIHF1ZSBlbHMgdmEgcGFyaXIgYSB0b3RzCg=="}

With the format we have defined as a template:

$ kubectl get secret vault-example-with-template -o jsonpath='{.data.somekey}' | base64 -d somethingelse: "data retrieved from Vault is s3cr3t"

Posted on 08/11/2022

Categories