添加 ExternalSecret 到 Yaml 文件部署到 K8s

Question

I'm trying to deploy a Kube.netes processor to a cluster on GCP GKE but the pod fails with the following error:

secret "service-account-credentials-dbt-test" not found: CreateContainerConfigError

This is my deployment.yaml file:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dbt-core-processor
  namespace: prod
  labels:
    app: dbt-core
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dbt-core
  template:
    metadata:
      labels:
        app: dbt-core
    spec:
      containers:
      - name: dbt-core-processor
        image: IMAGE
        resources:
          requests:
            cpu: 50m
            memory: 1Gi
          limits:
            cpu: 1
            memory: 2Gi
        env:
        - name: GOOGLE_APPLICATION_CREDENTIALS
          valueFrom:
            secretKeyRef:
              name: service-account-credentials-dbt-test
              key: service-account-credentials-dbt-test
---
apiVersion: kubernetes-client.io/v1
kind: ExternalSecret
metadata:
  name: service-account-credentials-dbt-test
  namespace: prod
spec:
  backendType: gcpSecretsManager
  data:
  - key: service-account-credentials-dbt-test
    name: service-account-credentials-dbt-test
    version: latest

When I run kubectl apply -f deployment.yml I get the following error:

deployment.apps/dbt-core-processor created
error: unable to recognize "deployment.yml": no matches for kind "ExternalSecret" in version "kubernetes-client.io/v1"

This creates my processor but the pod fails to spin up the secrets:

secret "service-account-credentials-dbt-test" not found: CreateContainerConfigError

How do I add the secrets from my secrets manager in GCP to this deployment?

Answer 1

ExternalSecret is a custom resource definition (CRD) and it looks like it is not installed on your cluster.

I googled kube.netes-client.io/v1 and it looks like you may be following instructions from the old, archived project that first provided this CRD? The GitHub repo pointed me to a maintained project that has replaced it.

The good news is that the current project has what looks like comprehensive documentation, including a guide to how to install the CRDs on your cluster and the proper configuration for the External secret .