1"use strict";(self.webpackChunkcnoe=self.webpackChunkcnoe||[]).push([[5926],{28453:(e,t,r)=>{r.d(t,{R:()=>o,x:()=>i});var n=r(96540);const s={},a=n.createContext(s);function o(e){const t=n.useContext(a);return n.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(a.Provider,{value:t},e.children)}},42846:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>d,frontMatter:()=>o,metadata:()=>n,toc:()=>l});const n=JSON.parse('{"id":"reference-implementation/local/secrets","title":"Secret Management","description":"utilizing CNOE with secrets","source":"@site/docs/reference-implementation/local/secrets.md","sourceDirName":"reference-implementation/local","slug":"/reference-implementation/local/secrets","permalink":"/docs/reference-implementation/local/secrets","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":1,"frontMatter":{"sidebar_position":1,"description":"utilizing CNOE with secrets","title":"Secret Management"},"sidebar":"tutorialSidebar","previous":{"title":"Infrastructure Control Plane","permalink":"/docs/reference-implementation/local/control-plane"},"next":{"title":"Set up IDP on Local Machine","permalink":"/docs/reference-implementation/local/idpbuilder"}}');var s=r(74848),a=r(28453);const o={sidebar_position:1,description:"utilizing CNOE with secrets",title:"Secret Management"},i=void 0,c={},l=[{value:"External Secrets Operator",id:"external-secrets-operator",level:2},{value:"TLS Certificates",id:"tls-certificates",level:2}];function p(e){const t={a:"a",code:"code",h2:"h2",p:"p",pre:"pre",...(0,a.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"external-secrets-operator",children:"External Secrets Operator"}),"\n",(0,s.jsxs)(t.p,{children:["If your organization requires sensitive data to be stored in a secret store such as Vault and Secrets Manager, you may need a way to retrieve secrets from your secret store into your cluster. ",(0,s.jsx)(t.a,{href:"https://external-secrets.io/latest/introduction/overview/",children:"External Secrets Operator"})," is a Kubernetes Operator that fetches secrets from external APIs and creates Kubernetes secrets."]}),"\n",(0,s.jsx)(t.p,{children:"The reference implementation uses this operator to sync secrets between the cluster and AWS Secrets Manager. Information such as generated user password, Keycloak admin password, and database password are stored as an entity in AWS secrets manager."}),"\n",(0,s.jsx)(t.h2,{id:"tls-certificates",children:"TLS Certificates"}),"\n",(0,s.jsx)(t.p,{children:"If you opted to use cert manager to manage certificates for you endpoints, certificates and their private keys are stored as Kubernetes secrets. If this does not meet your security standard, you can store it in a secret store of your choice, then use External Secrets Operator to sync it. An example manifest for Secrets Manager would look something like this."}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:'apiVersion: external-secrets.io/v1beta1\nkind: ExternalSecret\nmetadata:\n name: backstage-prod-tls\n namespace: backstage\nspec:\n refreshInterval: 12h\n secretStoreRef:\n name: keycloak\n kind: SecretStore\n target:\n name: backstage-prod-tls\n template:\n type: kubernetes.io/tls\n data:\n tls.crt: "{{ .public }}"\n tls.key: "{{ .private }}"\n data:\n - secretKey: private\n remoteRef:\n key: cnoe/tls/dev # path to the tls cert in Secrets Manager\n property: PRIVATE_KEY\n - secretKey: public\n remoteRef:\n key: cnoe/tls/dev\n property: CERT\n'})}),"\n",(0,s.jsx)(t.p,{children:"When removing the reference implementation installation from your cluster, the uninstall script will back up the secrets to a local directory. This is to avoid re-issuing Let's Encrypt certificate for the same host because Let's Encrypt has a limit on how many times you can request certificates in a given time."})]})}function d(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(p,{...e})}):p(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.