Encrypting secrets in Yandex Managed Service for Kubernetes

If you do not have the Yandex Cloud (CLI) command line interface yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

You can specify a key when creating a Managed Service for Kubernetes cluster in two ways:

• Using the key ID:

  yc managed-kubernetes cluster create \
    ...
    --kms-key-id <key_ID> \
    ...
  

• Using the key name:

  yc managed-kubernetes cluster create \
    ...
    --kms-key-name <key_name> \
    ...
  

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the documentation on the Terraform website or mirror website.

If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

Specify a key when creating a Managed Service for Kubernetes cluster:

1. Add a section named kms_provider to the Managed Service for Kubernetes cluster description:

   resource "yandex_kubernetes_cluster" "<cluster_name>" {
     ...
     kms_provider {
       key_id = "<key_ID>"
     }
   }
   

2. Make sure the configuration files are correct.

   1. In the command line, go to the folder where you created the configuration file.

   2. Run a check using this command:

      terraform plan
      

   If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out. This is a test step; no resources will be created.

3. Create a Managed Service for Kubernetes cluster.

   1. If the configuration does not contain any errors, run this command:

      terraform apply
      

   2. Confirm that you want to create the resources.

   After this, all required resources will be created in the specified folder and the IP addresses of the VMs will be displayed in the terminal. You can check the new resources and their configuration using the management console.

Specify the encryption key when creating a Managed Service for Kubernetes cluster. To do this, use the create REST API method for the Cluster resource or the ClusterService/Create gRPC API call.

Provide the key ID in the relevant kmsProvider field parameter.