如何识别 EKS 集群是否正在使用外部秘密存储提供程序

Question

I'm looking for a way to identify through CLI if a given EKS is using an external secret storage provider rather than use kube.netes secrets directly, and if it does, than which provider is being used.

Thanks for the help.

From what I've learned, it might be possible to use EKS cluster-describe EncryptionConfig section to get such information though I'm not 100% sure how to use it for my needs described above.

Answer 1

From what I gather, you're trying to use an external secret storage solution like AWS Secrets Manager as a source for the secrets in your cluster. To rope those secret values into your cluster, you can use the External Secrets Operator (ESO) . ESO will communicate with AWS Secrets Manager and create the secrets for you in the cluster. I have a video demonstrating this here . To save time, you can jump to 06:50 in the video that deals with your specific query.

In addition to this, you can add an envelope of encryption to your secrets in the cluster using KMS. Here are some links to help with that:

• https://www.eksworkshop.com/beginner/191_secrets/
• https://docs.aws.amazon.com/eks/latest/userguide/enable-kms.html