Skip to content

openshift-secrets-awssecman

Back OpenShift cluster secrets with AWS Secrets Manager via LookupUri references

Backs a cluster's secrets with AWS Secrets Manager through the DRP awssecman secret-store plugin. Nests the openshift-secrets base profile (which defines the references) and supplies the AWS URI grammar:

  • per-cluster prefix: <store>://aws?secret=<name>.<cluster-domain>/
  • pull secret: <store>://aws?secret=openshift/pull-secret&format=json

where <store> is the plugin instance named by openshift/secrets/store. The awssecman plugin ignores the URI host, so the literal aws is used there by convention; the secret is selected by the secret= query argument. The profile also carries openshift/secrets/type: awssecman (the plugin provider name) so content that must branch or validate per backend can read it instead of guessing from the reference shape; operators never set it by hand.

Usage

  1. Install the awssecman plugin content and configure an awssecman plugin instance; set AWS credentials/region on it as needed and record its name.
  2. Set openshift/secrets/store to that instance name.
  3. Ensure openshift/cluster-domain is set for the cluster.
  4. Apply this profile to the cluster.

See the openshift-secrets profile for how references resolve, the scope of covered params, write-through behavior, and the shared-profile RBAC caveat.

Objects that Reference openshift-secrets-awssecman

Not used in current content packs

Objects used by openshift-secrets-awssecman