Secrets on Spinnaker

Secrets in GCS

Mon, 01 Jan 0001 00:00:00 +0000

This example uses a bucket (mybucket) to store GitHub credentials and a kubeconfig file.

Authorization

Since you’re storing sensitive information you protect the bucket by restricting access to it. Encryption at rest is already provided automatically without additional setup.

Remember to run Spinnaker services with a service account that allows them to read that content.

Storing secrets

Storing credentials

Store your GitHub credentials in mybucket/spinnaker-secrets.yml:

github:
  password: <PASSWORD>
  token: <TOKEN>

Note: You could choose to store the password under different keys than github.password and github.token. You’d just need to change how to reference the secret .

Secrets in Google Secret Manager

Mon, 01 Jan 0001 00:00:00 +0000

This example uses secrets - mysecret1, mysecret2 - to store GitHub credentials and secret - mykubeconfig - to store kubeconfig file.

Authorization

Since you’re storing sensitive information you protect the secret by restricting access to it through IAM roles . Encryption at rest is already provided by default.

Remember to run Spinnaker services with a service account that allows them to read that content.

Storing secrets

Storing credentials

Store your GitHub token in a secret named mysecret either as a complete secret or as a value of one of the json keys:

Secrets in S3

Mon, 01 Jan 0001 00:00:00 +0000

This document describes how to set up Spinnaker secrets in an encrypted S3 bucket. This example uses a bucket ( mybucket) in the us-west-2 region to store GitHub credentials and a kubeconfig file. You can reference the bucket by its URL mybucket.us-west-2.amazonaws.com.

Authorization

Since you’re storing sensitive information, you protect the bucket by restricting access and enabling encryption .

Remember to run Spinnaker services with IAM roles that allow them to read that content.