Skip to main content

Secret Injection

This example builds on Configuration Management by adding secret injection from a cloud secret store.

What You'll Learn​

In this lesson, you'll learn:

  • How to inject secrets from cloud secret stores
  • Secret format and naming conventions
  • Secret rotation
  • Security best practices

What Gets Created​

In addition to resources from Configuration Management, the platform creates:

  • SecretStore - connection to cloud provider
  • ExternalSecret - syncs a specific secret from the cloud
  • Kubernetes Secret - created by the ExternalSecret and automatically mounted by the Platform Application Operator
  • IAM roles/permissions - automatically configured

What Changed​

Added the spec.secrets section:

apiVersion: meta.p6m.dev/v1alpha1
kind: PlatformApplication
metadata:
  name: demo-http-echo
  namespace: demo-http-echo
  labels:
    p6m.dev/app: demo-http-echo
spec:
  config:
    LOG_LEVEL: debug
    HTTP_PORT: "8080"
    ENVIRONMENT: dev
    APP_NAME: demo-http-echo
  # NEW
  secrets:
    - name: super-secret-data  # Must exist in cloud secret store
  # NEW
  deployment:
    image: mendhak/http-https-echo:31
    ports:
      - port: 8080
        protocol: http
    readinessProbe:
      port: 8080
      path: /
  networking:
    ingress:
      enabled: true
      path: /
      gateway: public-open

Create Secret in the Cloud​

We have a focused guide for creating secrets in your preferred cloud provider, check it out here.

Deploy Steps​

ArgoCD automatically updates to your PlatformApplication after the Platform Dispatch Action to update your .platform repository is run.

Let's use the Kinds filter to locate our ExternalSecrets, Secrets, and SecretStore which are the new objects that will be created.

ArgoCD view of external secret, secret, and secret store resourcesArgoCD view of external secret, secret, and secret store resources

How Secrets Work​

The platform uses the External Secrets Operator to:

  1. Fetch secrets from your cloud secret store
  2. Create Kubernetes Secrets with the secret data
  3. Inject as environment variables into your pods

Secret Format Requirements​

Secrets must be stored as key-value pairs (JSON object):

{
  "API_KEY": "abc123",
  "DATABASE_PASSWORD": "xyz789",
  "OAUTH_CLIENT_SECRET": "secret456"
}

Keys become environment variable names (use UPPERCASE_WITH_UNDERSCORES).

tip

Want to dive deeper? See Secret Injection - Details for cloud setup procedures, verification steps, and security best practices.

You've Completed the Tutorial! 🎉​

Further Learning:

  • Cloud Resources with Crossplane
  • Autoscaling with KEDA
  • Service Mesh configuration
  • Observability integration

Check the Platform Documentation for advanced topics.

Troubleshooting​

For common issues and solutions, see the Troubleshooting Guide.

Specific sections that may be helpful:

Cleanup​

Check out the Cleanup Instructions from the Basic Deployment lesson to remove all resources created in this walkthrough.

Make sure to also delete any secrets created in your cloud secret store to avoid incurring costs.