Skip to main content

How to use Kubernetes External Secret Operator with Secret Manager

Stephanie R.
Updated

Learn how to set up the Kubernetes External Secrets Operator to use the OVHcloud Secret Manager as a provider.

NOTE: This guide describes how to use External Secrets Operator with the HashiCorp Vault provider to access the OVHcloud Secret Manager through the HashiCorp Vault KV2-compatible API.

OVHcloud now provides a native External Secrets Operator provider. We recommend using it for new deployments. See the OVHcloud provider documentation.

 

Requirements

 

Instructions

Set up the Secret Manager

To allow access to the Secret Manager, you will need to have a token, the region, and the okms-id of your Secret Manager.

Credential creation

Create an IAM local user with access rights on your domain, or use a service account. See OKMS authentication methods for the full setup and IAM policy templates.

The user should be a member of a group with the ADMIN role. If you are using IAM policies instead, the user should have at least the following rights on the OKMS domain:

  • okms:apikms:secret/create
  • okms:apikms:secret/version/getData
  • okms:apikms:secret/get
  • okms:apiovh:secret/get

Alternatively, it's possible to create a user using OVHcloud CLI:

ovhcloud iam user create --login "secretmanager-b1033fdd-xxxx-xxxx-xxxx-xxxxxxxxx" --group ADMIN --description "A user created for Secret Manager, linked to xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx" --password "secretmanager-xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx" --email "secretmanager-xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx@ovhcloud.com"

Then create a Personal Access Token (PAT) user_pat:

Use the following API call:

POST /me/identity/user/{user}/token

With the following payload (fill it in with your own values):

{
  "description": "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx",
  "name": "pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"
}

The API will answer with:

{
  "creation": "2025-11-13T10:38:44.658926311Z",
  "description": "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx",
  "expiresAt": null,
  "lastUsed": null,
  "name": "pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx",
  "token": "eyJhbGciOiJ...punpVAg"
}

The PAT can be created with the OVHcloud CLI and the following command (fill it in with your own values):

ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"

CLI will answer with the token value:

✅ Token Secret-Manager created successfully, value: eyJhbGciOiJ...punpVAg

As an alternative, you can store the PAT directly in an environment variable:

PAT_TOKEN=$(ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx" -j  | jq .details.token |  tr -d '"') ; echo $PAT_TOKEN

Keep the value of the token field as it will never be prompted again and will be used to authenticate to the Secret Manager as user_pat.

 

Secret Manager information

You will also need the region and the okms-id of the OKMS domain you want to use. This ID and this region can be found in the OKMS domain dashboard or via the OVHcloud CLI:

$ ovhcloud okms list
┌──────────────────────────────────────┬─────────────┐
│ id                                   │ region      │
├──────────────────────────────────────┼─────────────┤
│ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx │ us-east-vin │
│ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx │ us-east-vin │
└──────────────────────────────────────┴─────────────┘

 

Set up the Secret Provider in Kubernetes

Install the External Secrets Operator (ESO) on your Kubernetes cluster

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
   external-secrets/external-secrets \
    -n external-secrets \
    --create-namespace \
    --set installCRDs=true

Check that the ESO is running:

$  kubectl get all -n external-secrets
NAME                                                    READY   STATUS    RESTARTS   AGE
pod/external-secrets-8cbc56569-9875p                    1/1     Running   0          12s
pod/external-secrets-cert-controller-565fcd479b-xbkcp   0/1     Running   0          12s
pod/external-secrets-webhook-7fb59d4b88-9tkl6           0/1     Running   0          12s

NAME                               TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
service/external-secrets-webhook   ClusterIP   10.3.43.102   <none>        443/TCP   13s

NAME                                               READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/external-secrets                   1/1     1            1           13s
deployment.apps/external-secrets-cert-controller   0/1     1            0           13s
deployment.apps/external-secrets-webhook           0/1     1            0           13s

NAME                                                          DESIRED   CURRENT   READY   AGE
replicaset.apps/external-secrets-8cbc56569                    1         1         1       13s
replicaset.apps/external-secrets-cert-controller-565fcd479b   1         1         0       13s
replicaset.apps/external-secrets-webhook-7fb59d4b88           1         1         0       13s

 

Create a secret containing the PAT

Create a secret.yaml file:

apiVersion: v1
kind: Secret
metadata:
  name: ovhcloud-vault-token
  namespace: external-secrets
stringData:
  token: <token>

The stringData field accepts the raw token — Kubernetes base64-encodes it when storing the secret. If you prefer to use the data field instead, you must base64-encode the token yourself first (echo -n "<token>" | base64).

Apply it with the kubectl apply -f secret.yaml command.

Alternatively, if the user_pat is stored in the PAT_TOKEN environment variable, create the secret directly with kubectl, which also handles the encoding:

kubectl create secret generic ovhcloud-vault-token -n external-secrets --from-literal=token=$PAT_TOKEN

The secret should have been created:

$ kubectl get secret ovhcloud-vault-token -n external-secrets
NAME                   TYPE     DATA   AGE
ovhcloud-vault-token   Opaque   1      5m

When you inspect the secret with kubectl get secret ovhcloud-vault-token -n external-secrets -o yaml, the value appears under data, base64-encoded.

 

Configure the External Secrets Operator

First, set up a ClusterSecretStore that is responsible for the synchronization with the Secret Manager. We configure the SecretStore using HashiCorp Vault with token authentication and with the OKMS endpoint as backend.

Add the user_pat as a secret to be able to use it in the charts.

To define a new ClusterSecretStore resource, create a clustersecretstore.yaml file with the following content:

apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-secret-store
spec:
  provider:
      vault:
        server: "https://<region>.okms.ovh.us/api/<okms_id>" # OKMS endpoint, fill with the correct region and your okms_id 
        path: "secret"
        version: "v2" 
        auth:
            tokenSecretRef:
              name: ovhcloud-vault-token # The k8s secret that contain your PAT
              key: token 
              namespace: external-secrets

Only token authentication is supported.

This integration works with a SecretStore as well.

The region name can be translated from your region location using:

GET /location

As an example for Vint Hill, Virginia, the OKMS endpoint is us-east-vin.okms.ovh.us.

Deploy the resource in your cluster:

kubectl apply -f clustersecretstore.yaml

 

Use the External Secrets Operator

Once the ClusterSecretStore is set up you can define the ExternalSecret that comes from the secret manager.

Create an externalsecret.yaml file with this content:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: docker-config-secret
  namespace: external-secrets
spec:
  refreshInterval: 30m
  secretStoreRef:
    name: vault-secret-store
    kind: ClusterSecretStore
  target:
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: "{{ .mysecret | toString }}"
    name: ovhregistrycred
    creationPolicy: Owner
  data:
  - secretKey: mysecret
    remoteRef:
      key: prod/va1/dockerconfigjson

Apply the resource in your cluster:

kubectl apply -f externalsecret.yaml

It will create a Kubernetes Secret object.

$ kubectl get secret -n external-secrets
NAME                                     TYPE                             DATA   AGE
...
ovhregistrycred                          kubernetes.io/dockerconfigjson   1      15m
...

For any additional information on how to manage the External Secrets Operator, refer to the dedicated documentation, using the HashiCorp Vault provider: https://external-secrets.io/latest/.

 

Go further

OKMS authentication methods

Use Secret Manager with REST API

For more information and tutorials, please see our other Manage & Operate support guides or explore the guides for other OVHcloud products and services.