Syncing with Yandex Lockbox secrets

External Secrets Operator enables you to set up syncing of Yandex Lockbox secrets with Yandex Managed Service for Kubernetes cluster secrets.

There are several schemas for integrating Yandex Lockbox with Managed Service for Kubernetes. The example below describes ESO as a Service:

To set up secret syncing:

1. Install the External Secrets Operator and set up Yandex Lockbox.
2. Configure the Managed Service for Kubernetes cluster.
3. Create an External Secret.

If you no longer need the resources you created, delete them.

You can also deploy an infrastructure for syncing Yandex Lockbox secrets with Managed Service for Kubernetes cluster secrets via Terraform using a ready-made configuration file.

Getting startedGetting started

Sign up in Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or register a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The cost of resources for syncing secrets includes:

• Fee for using the Managed Service for Kubernetes master (see Managed Service for Kubernetes pricing).
• Fee for a Managed Service for Kubernetes node group's computing resources and disks (see Yandex Compute Cloud pricing).

Create an infrastructureCreate an infrastructure

Set up your environmentSet up your environment

1. If you do not have the Yandex Cloud CLI yet, install and initialize it.

   The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

2. Install the jq utility:

   sudo apt update && sudo apt install jq
   

3. Install kubect and configure it to work with the new cluster.

Install the External Secrets Operator and set up Yandex LockboxInstall the External Secrets Operator and set up Yandex Lockbox

1. Follow this guide to install the External Secrets Operator.
2. Assign the service account you created when installing the External Secrets Operator the lockbox.payloadViewer role for the previously created lockbox-secret.

Configure the Managed Service for Kubernetes clusterConfigure the Managed Service for Kubernetes cluster

1. Create a ns namespace to store External Secrets Operator objects in:

   kubectl create namespace ns
   

2. Create a yc-auth secret with the sa-key.json key you created when installing the External Secrets Operator:

   kubectl --namespace ns create secret generic yc-auth \
     --from-file=authorized-key=sa-key.json
   

3. Create a SecretStore containing the yc-auth secret:

   kubectl --namespace ns apply -f - <<< '
   apiVersion: external-secrets.io/v1beta1
   kind: SecretStore
   metadata:
     name: secret-store
   spec:
     provider:
       yandexlockbox:
         auth:
           authorizedKeySecretRef:
             name: yc-auth
             key: authorized-key'
   

Create an External SecretCreate an External Secret

1. Create an object named ExternalSecret pointing to lockbox-secret in secret-store:

   kubectl --namespace ns apply -f - <<< '
   apiVersion: external-secrets.io/v1beta1
   kind: ExternalSecret
   metadata:
     name: external-secret
   spec:
     refreshInterval: 1h
     secretStoreRef:
       name: secret-store
       kind: SecretStore
     target:
       name: k8s-secret
     data:
     - secretKey: password
       remoteRef:
         key: <secret_ID>
         property: password'
   

   Where:

   • key: ID of the Yandex Lockbox lockbox-secret secret you created.
   • spec.target.name: New key name, k8s-secret. The External Secrets Operator will create this key and place the lockbox-secret parameters in it.

2. Make sure the new k8s-secret key contains the lockbox-secret value:

   kubectl --namespace ns get secret k8s-secret \
     --output=json | \
     jq --raw-output ."data"."password" | \
     base64 --decode
   

   The command result will contain the value of the password key of lockbox-secret:

   p@$$w0rd
   

Delete the resources you createdDelete the resources you created

Delete the resources you no longer need to avoid paying for them: