Skip to content

openshift/secrets/store

Name of the secret-store plugin instance used to back OpenShift cluster secrets

Names the DRP secret-store plugin instance (for example a vault, awssecman, or azkeyvault plugin instance) that backs OpenShift cluster secure params through a LookupUri. The value is used as the URI scheme in the references defined by the backend-specific profiles shipped in this bundle (openshift-secrets-vault, openshift-secrets-awssecman, and openshift-secrets-azkeyvault), for example:

Text Only
{{.ParamExpand "openshift/secrets/store"}}://value?path=<cluster-fqdn>/kubeconfig&format=json

For Azure Key Vault the URI host (the Key Vault name) is a separate value, openshift/secrets/azkeyvault/vault-name, which merely DEFAULTS to this param so that a plugin instance named identically to the Key Vault works with no extra configuration. Set vault-name explicitly to decouple the two. See the openshift-secrets-azkeyvault profile for details.

Opt-in

External-store backing is switched on by applying an openshift-secrets-<backend> profile to the cluster; this param is a required input of those profiles, not an independent switch. Setting it without applying a backend profile has no effect, and applying a backend profile without setting it leaves the references unresolvable. Leave both off for the default behavior, where cluster secrets are stored as local secure params encrypted at rest by DRP.

Requirements

  • A configured, healthy secret-store plugin instance of this name must exist.
  • openshift/cluster-domain must be set so the per-cluster path resolves.

There is intentionally no default: an unset value means no external store.

Objects that Reference openshift/secrets/store

Objects used by openshift/secrets/store

Not used in current content packs