External Secret Operator

REGION_CORD="ap-northeast-2"
CLUSTER_NAME="skills-eks-cluster"
Shell
복사

cat >secret-policy.json <<EOF
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"secretsmanager:GetResourcePolicy",
				"secretsmanager:GetSecretValue",
				"secretsmanager:DescribeSecret",
				"secretsmanager:ListSecretVersionIds"
			],
			"Resource": ["*"]
		},
      {
        "Effect": "Allow",
        "Action": ["kms:Decrypt"],
        "Resource": ["*"]
      }
    ]
}
EOF
Shell
복사

POLICY_ARN=$(aws --region "$REGION_CORD" --query Policy.Arn --output text iam create-policy --policy-name secretsmanager-policy --policy-document file://secret-policy.json)
Shell
복사

eksctl create iamserviceaccount \
    --name external-secrets-cert-controller \
    --region="$REGION_CORD" \
    --cluster "$CLUSTER_NAME" \
    --namespace=app \
    --attach-policy-arn "$POLICY_ARN" \
    --override-existing-serviceaccounts \
    --approve
Shell
복사

helm repo add external-secrets https://charts.external-secrets.io
Shell
복사

kubectl annotate serviceaccount external-secrets-cert-controller \
  meta.helm.sh/release-name=external-secrets \
  meta.helm.sh/release-namespace=app \
  -n app \
  --overwrite
Shell
복사

kubectl label serviceaccount external-secrets-cert-controller \
  app.kubernetes.io/managed-by=Helm \
  -n app \
  --overwrite
Shell
복사

cat > values.yaml <<EOF
{
  "installCRDs": true,
  "nodeSelector": {
    "skills": "app"
  },
  "webhook": {
    "nodeSelector": {
      "skills": "app"
    }
  },
  "certController": {
    "nodeSelector": {
      "skills": "app"
    }
  }
}
EOF
Shell
복사

helm install external-secrets \
   external-secrets/external-secrets \
   -n app \
   -f values.yaml \
   --set serviceAccount.create=false
Shell
복사

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secrets
  namespace: app
spec:
  provider:
    aws:
      service: SecretsManager
      region: ap-northeast-2
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-cert-controller
YAML
복사

kubectl apply -f secretstore.yaml
Shell
복사

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: application-db-secret
  namespace: app
spec:
  refreshInterval: 24m
  secretStoreRef:
    name: aws-secrets
    kind: SecretStore
  target:
    name: db-credentials
    creationPolicy: Owner
  data:
    - secretKey: MYSQL_USER
      remoteRef:
        key: skills-rds-secret
        property: username
    - secretKey: MYSQL_PASSWORD
      remoteRef:
        key: skills-rds-secret
        property: password
    - secretKey: MYSQL_HOST
      remoteRef:
        key: skills-rds-secret
        property: host
    - secretKey: MYSQL_PORT
      remoteRef:
        key: skills-rds-secret
        property: port
    - secretKey: MYSQL_DBNAME
      remoteRef:
        key: skills-rds-secret
        property: dbname
    - secretKey: REGION
      remoteRef:
        key: skills-rds-secret
        property: aws_region
YAML
복사

kubectl apply -f externalsecret.yaml
Shell
복사