Bring Your Own Secrets

To propagate secrets from the tenant to the management cluster, KubeLB provides the custom resource SyncSecret, a wrapper over the native Kubernetes secret. It ensures that no secrets from the management cluster are exposed to the tenants.

SyncSecret Example

Native Kubernetes Secret

kind: Secret
apiVersion: v1
metadata:
  name: mongodb-credentials
stringData:
  mongodb-password: "123456"
  mongodb-root-password: "123456"
type: Opaque

Converted to a Sync Secret

kind: SyncSecret
apiVersion: kubelb.k8c.io/v1alpha1
metadata:
  name: mongodb-credentials
stringData:
  mongodb-password: "123456"
  mongodb-root-password: "123456"
type: Opaque

Automation

To automate the creation of SyncSecrets from Kubernetes secrets, re-deploy the KubeLB CCM with the following modifications:

kubelb:
    enableSecretSynchronizer: true

This assigns CRUD access for secrets to the KubeLB controller and enables a syncer that converts secrets labelled with kubelb.k8c.io/managed-by: kubelb to SyncSecrets.