Integrating External Secrets Operator (ESO) K8s plugin with CipherTrust Secrets Manager (Akeyless)

Prerequisites

• A Kubernetes environment is deployed and working.

• Helm is installed. Refer to https://helm.sh/docs/intro/install/ for details.

• CipherTrust Manager is up and running. Refer to CipherTrust Manager Deployment for details.

Steps

On Helm CLI

1. Add the External Secrets Helm repository as shown below.

   helm repo add external-secrets https://charts.external-secrets.io
   

2. Create a new namespace. It will store all the external secret pods. In this integration we are using akeyless-eso as the namespace.

3. Install External Secrets using Helm.

   helm install external-secrets external-secrets/external-secrets -n akeyless-eso --create-namespace
   

   The above steps will deploy the External Secrets to your Kubernetes cluster using Helm.

On Akeyless Console

1. Create a akeylesscreds.yaml file to store the access ID, access Key, and access type in form of secrets. This file is used during Secret Store creation.

   apiVersion: v1
   kind: Secret
   metadata:
     name: akeyless-secret-creds
   type: Opaque
   stringData:
     accessId: "p-XXXX"
     accessType:  # api_key
     accessTypeParam:  # replace by the appropriate value for <access-key>
   

   

2. Create a secretstore.yaml file. This file is used to separate the concerns of authentication/access and the actual Secret and configuration needed for workloads.

   apiVersion: external-secrets.io/v1beta1
   kind: SecretStore
   metadata:
     name: akeyless-secret-store
   spec:
     provider:
       akeyless:
         # URL of your akeyless API
         akeylessGWApiURL: "https://CM-IP/akeyless-api/v2"
         caBundle: # Provide the server cert of CM signed by CA having the IP SAN field
         authSecretRef:
           secretRef:
             accessID:
               name: akeyless-secret-creds
               key: accessId
             accessType:
               name: akeyless-secret-creds
               key: accessType
             accessTypeParam:
               name: akeyless-secret-creds
               key: accessTypeParam
   

   

   For CSM, the caBundle is essential for verifying the certificate. In the above code, we have used the IP address of the CipherTrust Manager. Consequently, we need the CA certificate of the CipherTrust Manager having IP SAN field. Otherwise, the gateway will trigger an "x509 certificate error" as it won't be able to validate the private CA certificate of the CipherTrust Manager. To generate the certificate, please refer to the steps provided in the Steps to generate CA certificate on CipherTrust Manager section.

3. Create a file named externalsecret.yaml to store akeyless secret. Fetch secret from Akeyless and store it as a K8s secret on your cluster under Kind=ExternalSecret section of the externalsecret.yaml

   apiVersion: external-secrets.io/v1beta1
   kind: ExternalSecret
   metadata:
     name: akeyless-external-secret-example
   spec:
     refreshInterval: 1h
   
     secretStoreRef:
       kind: SecretStore
       name: akeyless-secret-store # Must match SecretStore on the cluster
   
     target:
       name: akeyless-secret-to-create # Name for the secret to be created on the cluster
       creationPolicy: Owner
   
     data:
       - secretKey: secretKey # Key given to the secret to be created on the cluster
         remoteRef:
           key: /path/to/your/secret # Full path of the secret on Akeyless
   

   

4. Deploy all the yaml files in the below sequence.

   kubectl apply -f <yaml-file-name> -n <namespace>
   
   kubectl apply -f akeylesscreds.yaml -n akeyless-eso
   kubectl apply -f secretstore.yaml -n akeyless-eso
   kubectl apply -f externalsecret.yaml -n akeyless-eso
   
   // Check the status and READY state of all the yaml files deployed to ensure there are no failures detected. If any of the deployment fails, debug and fix the error to proceed ahead.
   
   kubectl get externalsecret akeyless-external-secret-example -n akeyless-eso
   NAME                                               STORE                          REFRESH INTERVAL    STATUS             READY
   akeyless-external-secret-example   akeyless-secret-store   1h                               SecretSynced   True
   
   kubectl get secretstore akeyless-secret-store -n akeyless-eso
   NAME                           AGE    STATUS   CAPABILITIES   READY
   akeyless-secret-store   2d1h   Valid       ReadOnly         True
   

5. Verify whether the secret present at the path /Static-Secret/Akeyless in your Akeyless account is successfully synced to K8s cluster using the below command.

   kubectl get secret akeyless-secret-to-create -o jsonpath='{.data.secretKey}' -n akeyless-eso | base64 -d
   

   

   

Steps to generate server certificate on CipherTrust Manager

To generate server certificate having IP SAN field used for caBundle, perform the following steps:

1. Log on to the CipherTrust Manager GUI.

2. Navigate to CA > CSR Generator. The CSR Generator screen appears.

3. Select Generic CSR radio button and provide the following details:

   • Common name

   • Algorithm as RSA

   • IP address of the CipherTrust Manager machine.

   You may skip the remaining parameters as they are optional.

4. Click Generate CSR and download Private Key.

   Make sure to save the generated CSR and private key.

5. Navigate to CA > Local. The list of available CAs is displayed.

6. Click name of the any local CA displayed on the page. The Certificate issued screen by that CA is displayed.

7. Click Upload CSR and provide the following details:

   • Display name

   • CSR

   • Certificate Purpose as Server.

8. Click the ellipsis icon corresponding to the newly generated certificate and select download.

   Save the downloaded certificate.

9. Go back to the corresponding local CA. Click the ellipsis icon and select download.

   Save the downloaded CA.

10. Create a certificate chain by combining the following into a single file:

    • certificate

    • local CA certificate

    • private key

    Make sure to keep the private key at the bottom.

11. Navigate to Admin Settings > Interfaces.

12. Click the ellipsis icon corresponding to the web interface type and select Certificate Options.

    The Interface Certificate Options on 'web' screen is displayed.

13. Select Upload New Certificate and click OK.

14. On the Upload Certificate screen, do the following steps:

    • Upload the certificate downloaded in the step 9 and the private key downloaded in the step 5.

    • Select Format as PEM.

15. Click Upload Certificate.

16. Restart the CipherTrust Manager services.

17. Navigate to Admin Settings > Interfaces.

18. Click the ellipsis icon corresponding to the web interface type and select Download Certificate.

    Save the downloaded server certificate.

19. Encode the downloaded certificate to Base64 format.

    This encoded value is used for the caBundle.

Steps to generate server certificate using external CA on CipherTrust Manager

To generate server certificate having IP SAN field used for caBundle, perform the following steps:

1. Log on to the CipherTrust Manager GUI.

2. Create a certificate chain (using external platforms such as OpenSSL) by combining the following into a single file.

   • certificate

   • external CA certificate

   • private key

   Make sure to keep the private key at the bottom.

3. Navigate to Admin Settings > Interfaces.

4. Click the ellipsis icon corresponding to the web interface type and select Certificate Options.

   The Interface Certificate Options on 'web' screen is displayed.

5. Select Upload New Certificate and click OK.

6. On the Upload Certificate screen, do the following steps:

   • Upload the file created in the step 2.

   • Select Format as PEM.

7. Click Upload Certificate.

8. Restart the CipherTrust Manager services.

9. Navigate to Admin Settings > Interfaces.

10. Click the ellipsis icon corresponding to the web interface type and select Download Certificate.

    Save the downloaded server certificate.

11. Encode the downloaded certificate to Base64 format.

    This encoded value is used for the caBundle.

Troubleshooting