1. Documentation
×

Understanding secrets management in OKD

Secret management tools can be used to automate the lifecycle of sensitive data, such as passwords, private files, and certificates, by providing a centralized system to control and monitor access. This approach enhances security by limiting the uncontrolled spread of secrets and enables automation for the entire secret lifecycle, including updates, expiration, and removal.

OKD uses a flexible Operator and plugin design to decouple your workloads from external secret managers, ensuring you are not locked into a single vendor. In this model, the Operator acts as an intermediary, while a vendor-specific plugin manages communication between the cluster and the external storage. This allows applications to access secrets without needing to know the details of where or how they are stored.

Secrets management Operators in OKD

OKD offers a suite of supported Operators designed to secure and automate the management of sensitive data, such as external credentials and digital certificates. Each secrets management Operator provides quick starts and sample YAML manifests to streamline the onboarding process. These tools simplify installation and deployment, and help you build complex custom resources by using pre-defined YAML snippets. The following list details the key Operators available for these tasks:

  • Secrets Store CSI driver: Enables Kubernetes to connect to external systems, and mount credentials from the external system into an application workload.

  • External Secrets Operator for Red Hat OpenShift: Retrieves credentials stored in external management systems and makes them available within OKD as standard Kubernetes Secrets.

  • cert-manager Operator for Red Hat OpenShift: Manages the lifecycle of digital certificates that are used by applications running on OKD by automating the process of issuance and renewal.

Additional resources