1. Documentation
×

Understanding secrets management in OKD

Secret management tools can be used to automate the lifecycle of sensitive data, such as passwords, private files, and certificates, by providing a centralized system to control and monitor access. This approach enhances security by limiting the uncontrolled spread of secrets and enables automation for the entire secret lifecycle, including updates, expiration, and removal.

OKD uses a flexible Operator and plugin design to decouple your workloads from external secret managers, ensuring you are not locked into a single vendor. In this model, the Operator acts as an intermediary, while a vendor-specific plugin manages communication between the cluster and the external storage. This allows applications to access secrets without needing to know the details of where or how they are stored.

Secrets management Operators in OKD

OKD offers supported Operators to secure and automate the management of sensitive data such as external credentials and digital certificates.

The following Operators are available for secrets management:

  • Secrets Store CSI driver: Enables Kubernetes to connect to external systems, and mount credentials from the external system into an application workload.

  • External Secrets Operator for Red Hat OpenShift: Retrieves credentials stored in external management systems and makes them available within OKD as standard Kubernetes Secrets.

  • cert-manager Operator for Red Hat OpenShift: Manages the lifecycle of digital certificates that are used by applications running on OKD by automating the process of issuance and renewal.

Secrets management use cases

You can integrate secrets management Operators with other OKD components to securely manage, automate, and consume credentials across infrastructure and application workflows.

External Secrets Operator for Red Hat OpenShift use cases

You can integrate the External Secrets Operator with other OKD components to securely manage and inject credentials. Learn how to apply External Secrets Operator in real-world deployment strategies, by reviewing the following example.

Securing Red Hat OpenShift GitOps by using External Secrets Operator short-lived tokens

To reduce the security risk of compromised credentials, you can configure the External Secrets Operator to generate short-lived tokens. Red Hat OpenShift GitOps can then use these temporary tokens to securely authenticate when accessing GitHub repositories. You can refer to an example of the integration in the External Secrets Operator and GitOps demonstration.

Additional resources
Additional resources