{"id":15866995,"url":"https://github.com/amartingarcia/demo-external-secrets","last_synced_at":"2025-04-01T21:22:57.776Z","repository":{"id":122826366,"uuid":"517631903","full_name":"amartingarcia/demo-external-secrets","owner":"amartingarcia","description":"POC External Secrets + Reloader","archived":false,"fork":false,"pushed_at":"2022-07-25T11:14:17.000Z","size":3,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-07T13:56:12.570Z","etag":null,"topics":["external-secrets","kubernetes","reloader"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/amartingarcia.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-25T11:10:46.000Z","updated_at":"2024-07-31T14:42:04.000Z","dependencies_parsed_at":null,"dependency_job_id":"20be606b-b8d6-4d38-816e-41851764fec4","html_url":"https://github.com/amartingarcia/demo-external-secrets","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amartingarcia%2Fdemo-external-secrets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amartingarcia%2Fdemo-external-secrets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amartingarcia%2Fdemo-external-secrets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amartingarcia%2Fdemo-external-secrets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/amartingarcia","download_url":"https://codeload.github.com/amartingarcia/demo-external-secrets/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246710578,"owners_count":20821431,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["external-secrets","kubernetes","reloader"],"created_at":"2024-10-05T23:40:41.533Z","updated_at":"2025-04-01T21:22:57.756Z","avatar_url":"https://github.com/amartingarcia.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# External Secrets + Stakater/Reloader\n\n[Kubernetes External Secrets](https://github.com/external-secrets/kubernetes-external-secrets) allows you to use external secret management systems, like AWS Secrets Manager or HashiCorp Vault, to securely add secrets in Kubernetes.\n\n## External Secrets\n1. The controller will need permissions to access AWS Secrets Manager. [How to grant permissions](https://github.com/external-secrets/kubernetes-external-secrets#aws-based-backends).\n\n2. Create secrets in AWS Secret Manager:\n```bash\n$ aws secretsmanager create-secret --name credentials-test --secret-string '{\"username\":\"user\",\"password\":\"pass\"}' \u003e/dev/null\n$ aws secretsmanager create-secret --name kv/extsec/secret1 --secret-string '{\"intKey\": 11,\"objKey\": {\"strKey\": \"hello world\"}}' \u003e/dev/null\n```\n\n3. Install External Secrets:\n```bash\n$ helm repo add external-secrets https://external-secrets.github.io/kubernetes-external-secrets/\n$ helm install external-secrets -n external-secrets --create-namespace --debug --wait external-secrets/kubernetes-external-secrets\n```\n\n4. Show resource controller:\n```bash\n$ kubectl -n external-secrets get po\n\nNAME                                                           READY   STATUS    RESTARTS   AGE\nexternal-secrets-kubernetes-external-secrets-d79446c65-2dlfw   1/1     Running   0          2m\n```\n\n5. Create resource:\n```bash\n$ kubectl apply -f manifests/\n```\n\n6. Get resources:\n```bash\n# Get externalsecrets resources\n$ kubectl -n external-secrets get externalsecrets.kubernetes-client.io\n\nNAME               LAST SYNC   STATUS    AGE\ncredentials-test   3s          SUCCESS   1m\ntmpl-ext-sec       4s          SUCCESS   1m\n\n# Get secrets resources\n$ kubectl -n external-secrets get secrets\n\nNAME                 TYPE          DATA   AGE\ncredentials-test     Opaque        1      2m\ntmpl-ext-sec         Opaque        2      2m\n```\n\n7. Decode secret:\n```bash\n$ kubectl -n external-secrets get secret credentials-test --template {{.data.password}} | base64 -d\n\npass\n```\n\n8. Modify the AWS Secret Manager resource and decode the Kubernetes secret again:\n```bash\n# Modify secret\n$ aws secretsmanager put-secret-value --secret-id credentials-test --secret-string '{\"username\":\"user\",\"password\":\"pass1\"}' \u003e/dev/null\n\n# Get external secret resource\n$ kubectl -n external-secrets get externalsecrets.kubernetes-client.io\n\nNAME               LAST SYNC   STATUS    AGE\ncredentials-test   3s          SUCCESS   10m\ntmpl-ext-sec       3s          SUCCESS   10m\n\n# Decode secret\n$ kubectl -n external-secrets get secret credentials-test --template {{.data.password}} | base64 -d\n\npass1\n```\n\n## Stakater/Reloader\n\n### Problem:\nWe would like to watch if some change happens in ConfigMap and/or Secret; then perform a rolling upgrade on relevant DeploymentConfig, Deployment, Daemonset, Statefulset and Rollout.\n\n### Solution:\n[Reloader](https://github.com/stakater/Reloader) can watch changes in ConfigMap and Secret and do rolling upgrades on Pods with their associated DeploymentConfigs, Deployments, Daemonsets Statefulsets and Rollouts.\n\n1. Deploy Stakater/Reloader:\n```bash\n$ helm repo add stakater https://stakater.github.io/stakater-charts\n$ helm repo update\n$ helm install reloader -n reloader --create-namespace --debug --wait stakater/reloader\n```\n\n2. Uncomment the annotation in the deployment file and deploy:\n```yaml\n...\nmetadata:\n  annotations:\n    reloader.stakater.com/auto: \"true\"\n  name: nginx\n...\n```\n\n3. Change your secret in AWS Secret manager and decode again the secret:\n```bash\n# Change secret\n$ aws secretsmanager put-secret-value --secret-id credentials-test --secret-string '{\"username\":\"user\",\"password\":\"password1234\"}' \u003e/dev/null\n\n# Get external secret resource\n$ kubectl -n external-secrets get externalsecrets.kubernetes-client.io\n\nNAME               LAST SYNC   STATUS    AGE\ncredentials-test   3s          SUCCESS   10m\ntmpl-ext-sec       3s          SUCCESS   10m\n\n# Decode secret\n$ kubectl -n external-secrets get secret credentials-test --template {{.data.password}} | base64 -d\n\npassword1234\n\n# Show reloader logs\n$ kubectl -n tools logs reloader-reloader-65888d9cd9-p8g8x\n\ntime=\"2021-10-21T06:08:52Z\" level=info msg=\"Environment: Kubernetes\"\ntime=\"2021-10-21T06:08:52Z\" level=info msg=\"Starting Reloader\"\ntime=\"2021-10-21T06:08:52Z\" level=warning msg=\"KUBERNETES_NAMESPACE is unset, will detect changes in all namespaces.\"\ntime=\"2021-10-21T06:08:52Z\" level=info msg=\"Starting Controller to watch resource type: configMaps\"\ntime=\"2021-10-21T06:08:52Z\" level=info msg=\"Starting Controller to watch resource type: secrets\"\ntime=\"2021-10-21T07:46:24Z\" level=info msg=\"Changes detected in 'credentials-test' of type 'SECRET' in namespace 'external-secrets'\"\ntime=\"2021-10-21T07:46:24Z\" level=info msg=\"Updated 'nginx' of type 'Deployment' in namespace 'external-secrets'\"\n\n# Check de Pod status\n$ kubectl -n external-secrets get po\n\nNAME                                                           READY   STATUS        RESTARTS   AGE\nexternal-secrets-kubernetes-external-secrets-d79446c65-2dlfw   1/1     Running       0          3h24m\nnginx-asd518qwe-512fa                                          0/1     Terminating   0          1h\nnginx-76899c979-625fl                                          1/1     Running       0          26s\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famartingarcia%2Fdemo-external-secrets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Famartingarcia%2Fdemo-external-secrets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famartingarcia%2Fdemo-external-secrets/lists"}