How to Kubernetes Secret from parameter stored in the AWS System manager

user_9690015 0
Viewed 4926

I would like to avoid keeping secret in the Git as a best practise, and store it in AWS SSM.

Is there any way to get the value from AWS System Manager and use to create Kubernetes Secret?

aws-ssm kubernetes
4 Answers

I manage to create secret by fetching value from AWS Parameter store using the following script.

    cat <<EOF | ./kubectl apply -f -
    apiVersion: v1
    kind: Secret
    metadata:
      name: kiali
      namespace: istio-system
    type: Opaque
    data:
      passphrase: $(echo -n "`aws ssm get-parameter --name /dev/${env_name}/kubernetes/kiali_password --with-decrypt --region=eu-west-2 --output text --query Parameter.Value`" | base64 -w0)
      username: $(echo -n "admin" | base64 -w0)
    EOF
user_96900150

For sure, 12factors requires to externalize configuration outside Codebase.

For your question, there is an attempt to integrate AWS SSM (AWS Secret Manager) to be used as the single source of truth for Secrets.

You just need to deploy the controller :

helm repo add secret-inject https://aws-samples.github.io/aws-secret-sidecar-injector/
helm repo update
helm install secret-inject secret-inject/secret-inject

Then annotate your deployment template with 2 annotations:

  template:
    metadata:
      annotations:
        secrets.k8s.aws/sidecarInjectorWebhook: enabled
        secrets.k8s.aws/secret-arn: arn:aws:secretsmanager:us-east-1:123456789012:secret:database-password-hlRvvF

Other steps are explained here.

But I think that I highlighted the most important steps which clarifies the approach.

user_7475790

You can use GoDaddy external secrets. Installing it, creates a controller, and the controller will sync the AWS secrets within specific intervals. After creating the secrets in AWS SSM and installing GoDaddy external secrets, you have to create an ExternalSecret type as follows:

apiVersion: 'kubernetes-client.io/v1'
kind: ExtrenalSecret
metadata:
  name: cats-and-dogs
secretDescriptor:
  backendType: secretsManager
  data:
    - key: cats-and-dogs/mysql-password
      name: password`

This will create a Kubernetes secrets for you. That secret can be exposed to your service as an environment variable or through volume mount.

user_12374020

Use Kubernetes External Secret. This below solution uses Secret Manager (not SSM) but servers the purpose.

Deploy using Helm

$ `helm repo add external-secrets https://external-secrets.github.io/kubernetes-external-secrets/`
$ `helm install kubernetes-external-secrets external-secrets/kubernetes-external-secrets`

Create new secret with required parameter in AWS Secret Manager: For example - create a secret with secret name as "dev/db-cred" with below values.

{"username":"user01","password":"pwd@123"}

Secret.YAML:

apiVersion: kubernetes-client.io/v1
kind: ExternalSecret
metadata:
  name: my-kube-secret
  namespace: my-namespace
spec:
  backendType: secretsManager
  region: us-east-1
  dataFrom:
    - dev/db-cred

Refer it in helm values file as below

    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: my-kube-secret
          key: password
user_50325380
Related