-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Description
Describe the solution you'd like
Add a parameter which would automatically add a prefix to the paths of requested secrets in Parameter Store.
What is the added value?
This would allow easier portability of manifests, which look for secrets in paths, between environments using the same AWS account. For example, one SecretStore could be configured to provide secrets from parameters with the prefix /dev/my-app and another could be configured to provide them from /test/my-app and then ExternalSecrets could be configured to look for db-password and just change the SecretStore in which the value is being looked up.
Give us examples of the outcome
For the above example, assuming ParameterStore SecureString values in /dev/my-app/db-password and /test/my-app/db-password;
Dev SecretStore:
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: dev-secrets
spec:
provider:
aws:
service: ParameterStore
region: eu-west-2
role: arn:aws:iam::####
prefix: /dev/my-app/Test SecretStore:
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: test-secrets
spec:
provider:
aws:
service: ParameterStore
region: eu-west-2
role: arn:aws:iam::####
prefix: /test/my-app/ExternalSecret:
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: secrets
spec:
secretStoreRef:
name: dev-secrets # or test-secrets
kind: SecretStore
data:
- secretKey: dbPassword
remoteRef:
key: dbPassword # automatically prefixes with /dev/my-app/Observations (Constraints, Context, etc):
I don't have experience of Secrets Manager, so not sure whether this would be useful for that provider.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status