In the previous post, i showed how we synchronize secret from Vault to k8s, today with external-secrets.io i will guide you how to sync secret from AWS Secret Manager to k8s.

I will use minikube for demo purpose, also installing external-secrets using helm . Before working with CLI, i will create a alias kubectl and helm.

alias k=kubectl
alias h=helm

In the context of this post, i will

install external secret using helm
create a secret on aws , name it k8s-dev/api
create a aws iam access key for external secret
sync k8s-dev/api to dev namespace on k8s

Install External Secret Operator on K8s.

Install using helm

h repo add external-secrets https://charts.external-secrets.io
h install external-secrets \
   external-secrets/external-secrets \
    -n external-secrets \
    --create-namespace \
    --set installCRDs=true

Create Secret On AWS Secret Manager.

I will create a key-vault secret using aws console. Name it k8s-dev/api, the secret's content is

{
	"PORT": 5000,
	"USERNAME": "hello"
}

Create AWS Iam Key.

For demo purpose, i will create a iam user key that have permission to retrieve every secret started with k8s-dev secret.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "readprefixk8sdev",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:secretsmanager:ap-southeast-1:020213277421:secret:k8s-dev/*"
    }
  ]
}

For me after creating key i got this key pair. (This key will be deleted after done this post, so don't waste your time to copy it).

{
  "aws_access_key_id" = "AKIAQJNGOELWWV2OXODN"
  "aws_secret_access_key" = "iOPJoGK7R2aaqG64fy4WXw8kXGTZ2GmtcWcFdgOc"
}

Create Secret Store on K8S.

I will create a SecretStore crd in dev namespace. Remember to change your key pair.
First create dev namespace.

Create Secret Store crds, i also create a secret to save key pair value.

apiVersion: v1
kind: Secret
metadata:
  name: awssm-secret
  namespace: dev
type: Opaque
stringData:
  access-key-id: AKIAQJNGOELWWV2OXODN
  secret-access-key: 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
---
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secretsmanager
  namespace: dev
spec:
  provider:
    aws:
      service: SecretsManager
      region: ap-southeast-1
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: awssm-secret
            key: access-key-id
          secretAccessKeySecretRef:
            name: awssm-secret
            key: secret-access-key

Using kubectl to create it.

Using kubectl to retrieve this custom resource definition.

Sync Secret to K8S.

Currently on dev namespace, we only have awssm-secret.

Let create another ExternalSecret crd to synchronize k8s-dev/api secret to k8s. The content of api-secret.yaml is like this.

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: api-secret
  namespace: dev
spec:
  refreshInterval: 5s
  secretStoreRef:
    name: aws-secretsmanager
    kind: SecretStore
  target:
    name: api-secret
    creationPolicy: Owner
  dataFrom:
    - extract:
        key: k8s-dev/api

Creating using kubectl