Skip to content

openshift-secrets-azkeyvault

Back OpenShift cluster secrets with Azure Key Vault via LookupUri references

Backs a cluster's secrets with Azure Key Vault through the DRP azkeyvault secret-store plugin. Nests the openshift-secrets base profile (which defines the references) and supplies the Azure URI grammar:

  • per-cluster prefix: <store>://<vault-name>?type=secret&secret=<fqdn with dots rewritten to dashes>-
  • pull secret: <store>://<vault-name>?type=secret&format=json&secret=openshift-pull-secret

where <store> is the plugin instance named by openshift/secrets/store and <vault-name> is the Azure Key Vault name from openshift/secrets/azkeyvault/vault-name. The type=secret argument selects a secret (as opposed to a certificate). The profile also carries openshift/secrets/type: azkeyvault (the plugin provider name) so content that must branch or validate per backend can read it instead of guessing from the reference shape; operators never set it by hand.

The Key Vault name

Azure Key Vault is unusual among these backends: the URI host is the Key Vault name (it is prepended to .vault.azure.net), which is a different thing from the plugin instance name that DRP dispatches on (the URI scheme).

openshift/secrets/azkeyvault/vault-name supplies the host. Its default resolves to openshift/secrets/store, so the simple convention is: name your azkeyvault plugin instance identically to your Key Vault, set openshift/secrets/store to that name, and set nothing else. Set openshift/secrets/azkeyvault/vault-name explicitly to decouple the two, for example to point different clusters at different Key Vaults through one plugin instance naming scheme.

The instance name must be lowercase: DRP lowercases the URI scheme before dispatching to the plugin, so a mixed-case instance name would not match. Azure Key Vault names are already lowercase.

Per-cluster secret naming

Azure Key Vault secret names may contain only alphanumerics and dashes, so the per-cluster prefix rewrites the cluster FQDN's dots to dashes and joins the leaf with a dash: cluster ocp1 in domain example.com yields ocp1-example-com-kubeconfig. Secret names must start with a letter and be at most 127 characters; keep cluster names and domains within that budget after the longest leaf suffix is appended.

Usage

  1. Install the azkeyvault plugin content and configure an azkeyvault plugin instance named identically to your Azure Key Vault (see above). Azure credentials must be available to the DRP process.
  2. Set openshift/secrets/store to that name.
  3. Ensure openshift/cluster-domain is set for the cluster.
  4. Apply this profile to the cluster.

See the openshift-secrets profile for how references resolve, the scope of covered params, write-through behavior, and the shared-profile RBAC caveat.

Objects that Reference openshift-secrets-azkeyvault

Not used in current content packs

Objects used by openshift-secrets-azkeyvault