[New] External Secret Operator with Secret Manager #8653

gbarideau · 2025-11-06T16:54:32Z

What type of Pull Request is this?

New guide(s)

Description

New documentation to explain how to use Kubernetes External Secret Operator with the OVHcloud Secret Manager

Mandatory information

The translations in this Pull Request have been done using:

OVHcloud integrated translation LLM
Systran
Other tool (specify which tool was used)
This Pull Request didn't require any translation.
This Pull Request can be merged as soon as possible.
This Pull Request content should be replicated for the US OVHcloud documentation : YES

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

scraly · 2025-11-07T15:08:43Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+kind: SealedSecret
+metadata:
+name: token-secret
+namespace: default


Suggested change

namespace: default

namespace: default

il n'est pas conseillé de mettre des ressources perso dans le namespace default.

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

ldesauw · 2025-11-14T12:35:35Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+
+#### Configure External Secret Operator
+
+First, setup a `SecretStore` that is responsible of the synchronization with the Secret Manager.


ClusterSecretStore instead, the SecretStore doesn't work.
May change all appearance of it.

scraly · 2025-11-24T15:21:02Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+Then, install kubeseal cli to encrypt Secrets into Sealed Secrets
+
+```bash
+KUBESEAL_VERSION='' # Set this to, for example, KUBESEAL_VERSION='0.23.0'


0.33.1 est la version que je viens d'installer, la plus recente.
Le readme dont est extrait ce code est pas super a jour, donc plutot :

KUBESEAL_VERSION=$(curl -s https://api.github.com/repos/bitnami-labs/sealed-secrets/tags | jq -r '.[0].name' | cut -c 2-)

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

scraly · 2025-11-24T15:27:23Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+helm install external-secrets \
+external-secrets/external-secrets \
+-n external-secrets \
+--create-namespace \


Suggested change

--create-namespace \

--create-namespace

scraly · 2025-11-24T15:27:56Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+Add the `user_pat` as a secret to be able to use it in the charts.
+
+```yaml
+---


Suggested change

---

scraly · 2025-11-24T15:28:18Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+First, setup a `ClusterSecretStore` that is responsible of the synchronization with the Secret Manager.
+We configure the ClusterSecretStore using HashiCorp Vault with token authentification and with the OKMS endpoint as backend.
+
+Add the `user_pat` as a secret to be able to use it in the charts.


cette etape est à mettre apres installation de sealed-secret, dans la section "Setup Sealed Secret (optionnal)"

scraly · 2025-11-25T09:51:13Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+#### Use External Secret Operator
+
+Once the `ClusterSecretStore` is setup you can define `ExternalSecret` that comes from the secret manager.
+In the example we use a secret already created on the Secret Manager:


Suggested change

In the example we use a secret already created on the Secret Manager:

In the example we use a secret already created on the Secret Manager:

scraly · 2025-11-25T09:51:24Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+  - `login: admin`
+  - `password: my_secret_password`
+
+```yaml


Suggested change

```yaml

Create a `externalsecret.yaml` file with this content:

```yaml

scraly · 2025-11-25T09:51:43Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+```
+
+> [!info]
+> Only `ExternalSecret` are supported yet.


c'est a dire ?

scraly · 2025-11-25T09:52:06Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+
+> [!info]
+> Only `ExternalSecret` are supported yet.
+


Suggested change

Apply the resource in your cluster:

kubectl apply -f externalsecret.yaml

scraly · 2025-11-25T09:54:48Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+
+#### Deploy your application
+
+The secret should be created and available in kubernetes.


Suggested change

The secret should be created and available in kubernetes.

The secret should be created and available in the Kubernetes cluster.

Check:

$ kubectl get secret -n default

NAME TYPE DATA AGE

token-secret Opaque 1 17h

creds-secret Opaque 1 9m4s

…tore

scraly · 2025-12-18T14:16:20Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+---
+
+> [!primary]
+> Secret Manager is currently in beta phase. This guide can be updated in the future with the advances of our teams in charge of this product.


Suggested change

> Secret Manager is currently in beta phase. This guide can be updated in the future with the advances of our teams in charge of this product.

> Secret Manager is currently in Beta phase. This guide can be updated in the future with the advancements made by our teams in charge of this product.

scraly · 2025-12-18T14:17:55Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+
+### Setup the Secret Manager
+
+To allow access to the Secret Manager you will need to have a `token`, and the `region` and `okms-id` of your Secret Manager.


Suggested change

To allow access to the Secret Manager you will need to have a `token`, and the `region` and `okms-id` of your Secret Manager.

To allow access to the Secret Manager you will need to have a `token`, the `region` and `okms-id` of your Secret Manager.

scraly · 2025-12-18T14:18:56Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+    --set installCRDs=true
+```
+
+Check ESO is running :


Suggested change

Check ESO is running :

Check ESO is running:

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

scraly · 2025-12-18T14:27:29Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+>> ```
+>>
+> CLI
+>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values) :


Suggested change

>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values) :

>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values):

scraly · 2025-12-18T14:42:20Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values) :
+>>
+>> ```bash
+>> ovhcloud iam user {user} token create --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"


Suggested change

>> ovhcloud iam user {user} token create --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"

>> ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"

scraly · 2025-12-19T13:24:49Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values):
+>>
+>> ```bash
+>> ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"


Or you can create the token AND save it in an environment variable

PAT_TOKEN=$(ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx" -j | jq .details.token | tr -d '"') ; echo $PAT_TOKEN

scraly · 2025-12-19T13:25:20Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+Start by encoding your `user_pat` is base64 so it can be stored in a kubernetes secret.
+
+```bash
+$ echo -n "<token>" | base64


If you saved the token in an env variable (c.f my 1st comment today), you can directly do:

PAT_TOKEN_B64=$(echo -n $PAT_TOKEN | base64) ; echo $PAT_TOKEN_B64

scraly · 2025-12-19T13:28:14Z

pages/manage_and_operate/secret_manager/external-secret-operator/guide.en-gb.md

+ZXlKaG...wVkFn
+```
+
+Then create a `secret.yaml`:


Or, easily, create the Secret from the created environment variable (see my comment number 1 and 2 of this review):

$ kubectl create secret generic ovhcloud-vault-token -n external-secrets --from-literal=token=$PAT_TOKEN_B64 secret/ovhcloud-vault-token created

gbarideau added 5 commits November 3, 2025 10:40

First version of External Secret Operator documentation

b4038db

adding info about authentification method supported

c41a3c4

adding info about pushing secret not supported yet

0d3d6bc

minor fix

36b3fd8

date update

d11fd63

scraly requested changes Nov 7, 2025

View reviewed changes

gbarideau added 3 commits November 13, 2025 12:51

numerous fix following scraly comment

08fccab

indentation fix

400ac30

indentation fix

2a2ab17

ldesauw reviewed Nov 14, 2025

View reviewed changes

moving SecretStore to ClusterSecretStore

c5d472c

scraly requested changes Nov 25, 2025

View reviewed changes

Y0Coss added the Edition needed Content needs edition from the author before Quality Check by the Guides Team can start/resume label Dec 2, 2025

Y0Coss added the Guide creation The Pull Request contains at least 1 new guide (meta.yaml and index edition needed) label Dec 16, 2025

Documentation rework to support SecretStore instead of ClusterSecretS…

ddad50b

…tore

scraly requested changes Dec 18, 2025

View reviewed changes

adding missing section about secret creation

ff6bb79

scraly requested changes Dec 19, 2025

View reviewed changes

switching SecretStore for ClusterSecretStore

5d3a23d


		#### Configure External Secret Operator

		First, setup a `SecretStore` that is responsible of the synchronization with the Secret Manager.

	In the example we use a secret already created on the Secret Manager:
	In the example we use a secret already created on the Secret Manager:

-```yaml
+Create a `externalsecret.yaml` file with this content:
+```yaml



	Apply the resource in your cluster:

	kubectl apply -f externalsecret.yaml


		#### Deploy your application

		The secret should be created and available in kubernetes.

-The secret should be created and available in kubernetes.
+The secret should be created and available in the Kubernetes cluster.
+Check:
+$ kubectl get secret -n default
+NAME                   TYPE                             DATA   AGE
+token-secret   Opaque                           1      17h
+creds-secret        Opaque   1      9m4s

	> Secret Manager is currently in beta phase. This guide can be updated in the future with the advances of our teams in charge of this product.
	> Secret Manager is currently in Beta phase. This guide can be updated in the future with the advancements made by our teams in charge of this product.


		### Setup the Secret Manager

		To allow access to the Secret Manager you will need to have a `token`, and the `region` and `okms-id` of your Secret Manager.

	>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values) :
	>> PAT can also created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the command (fill with your values):

	>> ovhcloud iam user {user} token create --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"
	>> ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"

[New] External Secret Operator with Secret Manager #8653

Are you sure you want to change the base?

[New] External Secret Operator with Secret Manager #8653

Uh oh!

Conversation

gbarideau commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of Pull Request is this?

Description

Mandatory information

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

gbarideau commented Nov 6, 2025 •

edited

Loading