cloudforet-io/secret

Secret Service

SpaceONE Secret Service

Secret Service supports multiple backend.

• AWSSecretManager
• Vault
• Consul
• etcd
• MongoDB

Examples

AWSSecretsManagerConnector

BACKEND: AWSSecretManagerConnector
CONNECTORS:
    AWSSecretManagerConnector:
        aws_access_key_id: xxxxxxxxx
	aws_secret_access_key: yyyyyyyy
	region_name: aws-region-name

ConsulConnector

BACKEND: ConsulConnector
CONNECTORS:
    ConsulConnector:
        host: CONSUL_HOST_FQDN
	port: CONSUL_PORT

if you want to know the CONSUL_HOST_FQDN, comand kubectl get svc. In this case, CONSUL_HOST_FQDN is spaceone-consule-server.

$ kubectl get svc
NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                   AGE
...
spaceone-consul-dns      ClusterIP   10.100.170.168   <none>        53/TCP,53/UDP                                                             85m
spaceone-consul-server   ClusterIP   None             <none>        8500/TCP,8301/TCP,8301/UDP,8302/TCP,8302/UDP,8300/TCP,8600/TCP,8600/UDP   85m
...

MongoDBConnector

BACKEND: MongoDBConnector
CONNECTORS:
    MongoDBConnector:
        host: MONGO_HOST
        port': 27017,
        username': MONGO_USER,
        password': MONGO_PASSWD

EtcdConnector

BACKEND: EtcdConnector
CONNECTORS:
    EtcdConnector:
        host: ETCD_HOST
        port': 2379

secret's Issues

Implement to store encrypted data in MongoDB

Discussed in cloudforet-io/cloudforet#69

^{Originally posted by jihyungSong December 7, 2022}
Propose Date : 2022-11-17
Proposer : @jihyungSong

---

Currently, Cloudforet is to store sensitive data such as the user's Access Key in a more safety way through the Secret micro service.
(https://github.com/cloudforet-io/secret)

About the Secret service, it is supported using various backend systems.

• AWS Secrets Manager
• Consul by Hashicorp
• Vault by Hashicorp
• etcd of CNCF

I suggest to add MongoDB as a backend for Secret service.
(https://www.mongodb.com/)

Mongodb is the most influential database for storing documents based, and it is also used as a database for Cloudforet, so it is easy to integrate.

However, since it is not encrypted when stored in MongoDB, additional implementation of the encryption handler in the Secret service will be inevitable.

Add etcd connector

This issue was issued based on the content suggested in Discussion.

Related Suggestion

• cloudforet-io/cloudforet#17

---

The etcd connector is currently developed based on the latest stable version, v3.5.

• Documentation : https://etcd.io/docs/v3.5/
• Python SDK : https://python-etcd3.readthedocs.io/en/latest/

Add Trusted Secret