Syncing with Yandex Managed Service for Kubernetes secrets

External Secrets Operator enables you to set up syncing of Yandex Lockbox secrets with Managed Service for Kubernetes cluster secrets.

There are several schemas for integrating Yandex Lockbox with Managed Service for Kubernetes. The example below describes ESO as a Service:

To set up secret syncing:

1. Install the External Secrets Operator and set up Yandex Lockbox.
2. Configure the Managed Service for Kubernetes cluster.
3. Create an External Secret.

If you no longer need the resources you created, delete them.

You can also deploy an infrastructure for syncing Yandex Lockbox secrets with Managed Service for Kubernetes cluster secrets via Terraform using a ready-made configuration file.

Getting startedGetting started

Sign up for Yandex Cloud and create a billing account:

1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The cost of resources for syncing secrets includes:

• Fee for using the Managed Service for Kubernetes master (see Managed Service for Kubernetes pricing).
• Fee for a Managed Service for Kubernetes node group's computing resources and disks (see Yandex Compute Cloud pricing).

Create an infrastructureCreate an infrastructure

Configure the environmentConfigure the environment

1. If you do not have the Yandex Cloud command line interface yet, install and initialize it.

   The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

2. Install the jq utility:

   sudo apt update && sudo apt install jq
   

3. Install kubectl and configure it to work with the created cluster.

Install the External Secrets Operator and set up Yandex LockboxInstall the External Secrets Operator and set up Yandex Lockbox

1. Follow this guide to install the External Secrets Operator.
2. Assign to the service account you created when installing the External Secrets Operator the lockbox.payloadViewer role for the previously created lockbox-secret.

Configure a Managed Service for KubernetesConfigure a Managed Service for Kubernetes

1. Create a ns namespace to store External Secrets Operator objects in:

   kubectl create namespace ns
   

2. Create a yc-auth secret with the sa-key.json key that you created when installing the External Secrets Operator:

   kubectl --namespace ns create secret generic yc-auth \
     --from-file=authorized-key=sa-key.json
   

3. Create a SecretStore that contains the yc-auth secret:

   kubectl --namespace ns apply -f - <<< '
   apiVersion: external-secrets.io/v1alpha1
   kind: SecretStore
   metadata:
     name: secret-store
   spec:
     provider:
       yandexlockbox:
         auth:
           authorizedKeySecretRef:
             name: yc-auth
             key: authorized-key'
   

Create an External SecretCreate an External Secret

1. Create an object named ExternalSecret pointing to lockbox-secret in secret-store:

   kubectl --namespace ns apply -f - <<< '
   apiVersion: external-secrets.io/v1alpha1
   kind: ExternalSecret
   metadata:
     name: external-secret
   spec:
     refreshInterval: 1h
     secretStoreRef:
       name: secret-store
       kind: SecretStore
     target:
       name: k8s-secret
     data:
     - secretKey: password
       remoteRef:
         key: <secret_id>
         property: password'
   

   Where:

   • key: ID of the previously created Yandex Lockbox secret named lockbox-secret.
   • spec.target.name: Name of the new key (k8s-secret). The External Secrets Operator creates this key and inserts the parameters of lockbox-secret.

2. Make sure that the new k8s-secret key contains the lockbox-secret value:

   kubectl --namespace ns get secret k8s-secret \
     --output=json | \
     jq --raw-output ."data"."password" | \
     base64 --decode
   

   The command result will contain the value of the password key of lockbox-secret:

   p@$$w0rd
   

Delete the resources you createdDelete the resources you created

Delete the resources you no longer need to avoid paying for them: