We use Vault and External Secrets Operator for managing secrets confidentially in git.
Vault & ESO#
This section contains documentations/instructions on how to interact with the Operate First Cloud Vault and ESO instance.
Vault URL: https://vault-ui-vault.apps.smaug.na.operate-first.cloud - login with OIDC provider method.
We use External Secrets Operator (ESO) to manage our secrets declaratively in git.
ESO allows us to store our K8S / OCP secrets in git declaratively without compromising on the security of the platform.
How can my team use OPF Vault to manage our secrets via GitOps?#
If you or your team has a namespace in the OPF cloud, you can use our [External Secrets Operator][ESO] (ESO) to deploy
what are called
ExternalSecrets (ES) which can be then stored in Git. This
ExternalSecret contains information about
K8s secret, like where the
data for your K8s
Secret resides, what sort of
metadata.labels it should have. The great thing about ES is that they themselves do not contain any confidential data,
so you can store these in Git instead of your
Secret. See example here.
You can learn more about this resource here.
Secret data is stored in our Vault instance. When you deploy your
ES, ESO will fetch your data from the
path defined in your
ES and convert that into a K8s secret.
How to get started?#
Assuming your team has gone through the formal onboarding process and your team has an OCP group and namespace then you will need to additionally get onboarded by an Operate First Admin. The admins will have to follow the instructions here to onboard your team. Start by creating an issue here, requesting access to OPF vault.
Once onboarded, you can follow the instructions here to store data in your Vault path,
then create an
External Secret to fetch this data and convert it to your