Syncing with Yandex Managed Service for Kubernetes secrets

External Secrets Operator enables you to set up syncing secrets in Yandex Lockbox with those in a Yandex Managed Service for Kubernetes cluster.

There are various options for integrating Yandex Lockbox with Managed Service for Kubernetes. As an example, we will use ESO as a Service:

To set up secret syncing:

1. Install External Secrets Operator and set up Yandex Lockbox.
2. Configure your Managed Service for Kubernetes cluster.
3. Create an External Secret.

If you no longer need the resources you created, delete them.

You can also use a ready-made configuration file to deploy the infrastructure for syncing Yandex Lockbox secrets with Managed Service for Kubernetes cluster secrets via Terraform. For more information, see Create the infrastructure on the Terraform tab.

Getting startedGetting started

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

The cost of resources for syncing secrets includes:

• Fee for using a Managed Service for Kubernetes master (see Managed Service for Kubernetes pricing).
• Fee for Managed Service for Kubernetes node group's computing resources and disks (see Yandex Compute Cloud pricing).

Create the infrastructureCreate the infrastructure

Set up your environmentSet up your environment

1. If you do not have the Yandex Cloud CLI yet, install and initialize it.

   The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

2. Install jq:

   sudo apt update && sudo apt install jq
   

3. Install kubectl and configure it to work with the new cluster.

Install External Secrets Operator and set up Yandex LockboxInstall External Secrets Operator and set up Yandex Lockbox

1. Follow this guide to install the External Secrets Operator.
2. Assign the service account you created when installing External Secrets Operator the lockbox.payloadViewer role for the previously created lockbox-secret.

Configure your Managed Service for Kubernetes clusterConfigure your Managed Service for Kubernetes cluster

1. Create a ns namespace to store External Secrets Operator objects in:

   kubectl create namespace ns
   

2. Create a yc-auth secret with the sa-key.json key you created when installing the External Secrets Operator:

   kubectl --namespace ns create secret generic yc-auth \
     --from-file=authorized-key=sa-key.json
   

3. Create a SecretStore containing the yc-auth secret:

   kubectl --namespace ns apply -f - <<< '
   apiVersion: external-secrets.io/v1beta1
   kind: SecretStore
   metadata:
     name: secret-store
   spec:
     provider:
       yandexlockbox:
         auth:
           authorizedKeySecretRef:
             name: yc-auth
             key: authorized-key'
   

Create an External SecretCreate an External Secret

1. Create an ExternalSecret object pointing to lockbox-secret in secret-store:

   kubectl --namespace ns apply -f - <<< '
   apiVersion: external-secrets.io/v1beta1
   kind: ExternalSecret
   metadata:
     name: external-secret
   spec:
     refreshInterval: 1h
     secretStoreRef:
       name: secret-store
       kind: SecretStore
     target:
       name: k8s-secret
     data:
     - secretKey: password
       remoteRef:
         key: <secret_ID>
         property: password'
   

   Where:

   • key: ID of the Yandex Lockbox secret you created, i.e., lockbox-secret.
   • spec.target.name: New key name, k8s-secret. External Secrets Operator will create this key and place the lockbox-secret parameters in it.

2. Make sure the new k8s-secret key contains the lockbox-secret value:

   kubectl --namespace ns get secret k8s-secret \
     --output=json | \
     jq --raw-output '."data"."password"' | \
     base64 --decode
   

   The command returns the password key value from lockbox-secret:

   p@$$w0rd
   

Delete the resources you createdDelete the resources you created

Delete the resources you no longer need to avoid paying for them: