Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: typo in sync k8s doc #473

Merged
merged 1 commit into from
Apr 13, 2021
Merged

fix: typo in sync k8s doc #473

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
214 changes: 107 additions & 107 deletions ...n/configurations/sync-with-k8-secretes.md → ...n/configurations/sync-with-k8s-secrets.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,107 +1,107 @@
---
type: docs
title: "Sync Mounted Content with Kubernetes Secret"
linkTitle: "Sync Mounted Content with Kubernetes Secret"
weight: 1
description: >
How to sync mounted content with Kubernetes secret
---
<details>
<summary>Examples</summary>
- `SecretProviderClass`
```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
name: azure-sync
spec:
provider: azure
secretObjects: # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
- secretName: foosecret
type: Opaque
labels:
environment: "test"
data:
- objectName: secretalias # name of the mounted content to sync. this could be the object name or object alias
key: username
parameters:
usePodIdentity: "true"
keyvaultName: "$KEYVAULT_NAME" # the name of the KeyVault
objects: |
array:
- |
objectName: $SECRET_NAME
objectType: secret # object types: secret, key or cert
objectAlias: secretalias
objectVersion: $SECRET_VERSION # [OPTIONAL] object versions, default to latest if empty
- |
objectName: $KEY_NAME
objectType: key
objectVersion: $KEY_VERSION
tenantId: "tid" # the tenant ID of the KeyVault
```
- `Pod` yaml
```yaml
kind: Pod
apiVersion: v1
metadata:
name: busybox-secrets-store-inline
spec:
containers:
- name: busybox
image: k8s.gcr.io/e2e-test-images/busybox:1.29
command:
- "/bin/sleep"
- "10000"
volumeMounts:
- name: secrets-store01-inline
mountPath: "/mnt/secrets-store"
readOnly: true
volumes:
- name: secrets-store01-inline
csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: "azure-sync"
```
</details>
### How to sync mounted content with Kubernetes secret
In some cases, you may want to create a Kubernetes Secret to mirror the mounted content. Use the optional `secretObjects` field to define the desired state of the synced Kubernetes secret objects.
> NOTE: Make sure the `objectName` in `secretObjects` matches the file name of the mounted content. If object alias used, then it should be the object alias else this would be the object name.
{{% alert title="NOTE" color="warning" %}}
- The secrets will only sync once you *start a pod mounting the secrets*. Solely relying on the syncing with Kubernetes secrets feature thus does not work.
- The Kubernetes secrets will be synced to the same namespace as the application pod and `SecretProviderClass`.
{{% /alert %}}
A `SecretProviderClass` custom resource should have the following components:
```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
name: my-provider
spec:
provider: azure
secretObjects: # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
- data:
- key: username # data field to populate
objectName: foo1 # name of the mounted content to sync. this could be the object name or the object alias
secretName: foosecret # name of the Kubernetes Secret object
type: Opaque # type of the Kubernetes Secret object e.g. Opaque, kubernetes.io/tls
...
```
> NOTE: Here is the list of supported Kubernetes Secret types: `Opaque`, `kubernetes.io/basic-auth`, `bootstrap.kubernetes.io/token`, `kubernetes.io/dockerconfigjson`, `kubernetes.io/dockercfg`, `kubernetes.io/ssh-auth`, `kubernetes.io/service-account-token`, `kubernetes.io/tls`.
- Here is a sample [`SecretProviderClass` custom resource](https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/examples/sync-as-kubernetes-secret/synck8s_v1alpha1_secretproviderclass.yaml) that syncs a secret from Azure Key Vault to a Kubernetes secret.
- To view an example of type `kubernetes.io/tls`, refer to the [example](https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/examples/sync-as-kubernetes-secret/tls_synck8s_v1alpha1_secretproviderclass.yaml).
- To view an example of type `kubernetes.io/dockerconfigjson`, refer to the [example](https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/examples/sync-as-kubernetes-secret/dockerconfigjson_synck8s_v1alpha1_secretproviderclass.yaml) that syncs `dockerconfigjson` from Azure Key Vault to a Kubernetes secret.
---
type: docs
title: "Sync Mounted Content with Kubernetes Secret"
linkTitle: "Sync Mounted Content with Kubernetes Secret"
weight: 1
description: >
How to sync mounted content with Kubernetes secret
---

<details>
<summary>Examples</summary>

- `SecretProviderClass`
```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
name: azure-sync
spec:
provider: azure
secretObjects: # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
- secretName: foosecret
type: Opaque
labels:
environment: "test"
data:
- objectName: secretalias # name of the mounted content to sync. this could be the object name or object alias
key: username
parameters:
usePodIdentity: "true"
keyvaultName: "$KEYVAULT_NAME" # the name of the KeyVault
objects: |
array:
- |
objectName: $SECRET_NAME
objectType: secret # object types: secret, key or cert
objectAlias: secretalias
objectVersion: $SECRET_VERSION # [OPTIONAL] object versions, default to latest if empty
- |
objectName: $KEY_NAME
objectType: key
objectVersion: $KEY_VERSION
tenantId: "tid" # the tenant ID of the KeyVault
```

- `Pod` yaml
```yaml
kind: Pod
apiVersion: v1
metadata:
name: busybox-secrets-store-inline
spec:
containers:
- name: busybox
image: k8s.gcr.io/e2e-test-images/busybox:1.29
command:
- "/bin/sleep"
- "10000"
volumeMounts:
- name: secrets-store01-inline
mountPath: "/mnt/secrets-store"
readOnly: true
volumes:
- name: secrets-store01-inline
csi:
driver: secrets-store.csi.k8s.io
readOnly: true
volumeAttributes:
secretProviderClass: "azure-sync"
```
</details>

### How to sync mounted content with Kubernetes secret

In some cases, you may want to create a Kubernetes Secret to mirror the mounted content. Use the optional `secretObjects` field to define the desired state of the synced Kubernetes secret objects.

> NOTE: Make sure the `objectName` in `secretObjects` matches the file name of the mounted content. If object alias used, then it should be the object alias else this would be the object name.

{{% alert title="NOTE" color="warning" %}}

- The secrets will only sync once you *start a pod mounting the secrets*. Solely relying on the syncing with Kubernetes secrets feature thus does not work.
- The Kubernetes secrets will be synced to the same namespace as the application pod and `SecretProviderClass`.
{{% /alert %}}

A `SecretProviderClass` custom resource should have the following components:

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
name: my-provider
spec:
provider: azure
secretObjects: # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
- data:
- key: username # data field to populate
objectName: foo1 # name of the mounted content to sync. this could be the object name or the object alias
secretName: foosecret # name of the Kubernetes Secret object
type: Opaque # type of the Kubernetes Secret object e.g. Opaque, kubernetes.io/tls
...
```

> NOTE: Here is the list of supported Kubernetes Secret types: `Opaque`, `kubernetes.io/basic-auth`, `bootstrap.kubernetes.io/token`, `kubernetes.io/dockerconfigjson`, `kubernetes.io/dockercfg`, `kubernetes.io/ssh-auth`, `kubernetes.io/service-account-token`, `kubernetes.io/tls`.

- Here is a sample [`SecretProviderClass` custom resource](https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/examples/sync-as-kubernetes-secret/synck8s_v1alpha1_secretproviderclass.yaml) that syncs a secret from Azure Key Vault to a Kubernetes secret.
- To view an example of type `kubernetes.io/tls`, refer to the [example](https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/examples/sync-as-kubernetes-secret/tls_synck8s_v1alpha1_secretproviderclass.yaml).
- To view an example of type `kubernetes.io/dockerconfigjson`, refer to the [example](https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/examples/sync-as-kubernetes-secret/dockerconfigjson_synck8s_v1alpha1_secretproviderclass.yaml) that syncs `dockerconfigjson` from Azure Key Vault to a Kubernetes secret.