The module lifecycle stage: General Availability

Available in:  CE, BE, SE, SE+, EE

How to explicitly enable the module…

You may explicitly enable or disable the module in one of the following ways:

  • Via Deckhouse web UI. In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the secrets-store-integration module and enable (or disable) the “Module enabled” toggle. Save changes.

    Example:

    Module enable/disable interface

  • Via Deckhouse CLI (d8).

    Use the d8 system module enable command for enabling, or d8 system module disable command for disabling the module (you need Deckhouse CLI (d8), configured to work with the cluster).

    Example of enabling the module:

    d8 system module enable secrets-store-integration

  • Using ModuleConfig secrets-store-integration.

    Set spec.enabled to true or false in ModuleConfig secrets-store-integration (create it if necessary);

    Example of a manifest to enable module secrets-store-integration:

    apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: secrets-store-integration
spec:
  enabled: true

How to configure the module…

You can configure the module in one of the following ways:

  • Via Deckhouse web UI.

    In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the secrets-store-integration module and enable the “Advanced Settings” switch. Fill in the required fields in the “Configuration” tab or specify the module settings in YAML format on the “YAML” tab, excluding the settings section. Save the changes.

    Example:

    Module Setup Interface

    You can also edit the ModuleConfig object secrets-store-integration on the “YAML” tab in the module settings window (“System” → “System Management” → “Deckhouse” → “Modules”, open the module secrets-store-integration) by specifying the schema version in the spec.version parameter and the necessary module parameters in the spec.settings section.

  • Via Deckhouse CLI (d8) (requires Deckhouse CLI (d8) configured to work with the cluster).

    Edit the existing ModuleConfig secrets-store-integration (for more details on configuring Deckhouse, see the documentation) by executing the following command:

    d8 k edit mc secrets-store-integration

    Make the necessary changes in the spec.settings section. If necessary, specify the schema version in the spec.version parameter. Save the changes.

    You can also create a file with manifest for ModuleConfig secrets-store-integration using the example below. Fill in the spec.settings section with the required module parameters. If necessary, specify the schema version in the spec.version parameter.

    Apply the manifest using the following command (indicate the manifest file name):

    d8 k apply -f <FILENAME>

    Example of a manifest for ModuleConfig secrets-store-integration:

    apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: secrets-store-integration
spec:
  version: 1
  enabled: true
  settings: # Module parameters from the "Parameters" section below.

Requirements

To the Deckhouse version: 1.71 and above.

Parameters

Schema version: 1

  • settings
    object
    • settings.connection
      object
      • settings.connection.authPath
        string
        Path in Stronghold or Vault that is used to authenticate a Kubernetes cluster.

        Default: kubernetes

        Pattern: ^[A-Za-z0-9-_]+$

        Examples: 


        authPath: kubernetes

        authPath: kube-dev
      • settings.connection.caCert
        string

        CA certificate in PEM format for connecting to Stronghold or Vault.

        If this parameter is not specified, the system ca-certificates are used.

        Pattern: ^-----BEGIN CERTIFICATE----- (.+ ){5}

      • settings.connection.namespace
        string
        Namespace in a Vault-compatible store.

        Pattern: ^[A-Za-z0-9-_\/]+$

        Examples: 


        namespace: ns1

        namespace: ns1/sub-ns2
      • settings.connection.url
        string
        Stronghold or Vault address used for connecting integrations and retrieving secrets.

        Pattern: ^https://[\.:0-9a-zA-Z-]+$

        Example: 


        url: https://vault.mycompany.com:8200
    • settings.connectionConfiguration
      string

      Secret store connection mode:

      • DiscoverLocalStronghold: For automatic connection to the internal Stronghold service in the cluster.
      • Manual: For using an external Stronghold or Vault.

      Default: DiscoverLocalStronghold

      Allowed values: Manual, DiscoverLocalStronghold