How can I use GCP secret manager in Anthos cluster

Question

I want to create two Anthos cluster's in GCP one is GKE and second is EKS (AWS Kubernetes) and I want to store secret in GCP secrete manager, use those secrets in both GKE and EKS, What is good and secured way to do it ?

Answer 1

You can use Secret Store CSI Driver for this purpose, it will allow you to access the secrets stored in the Secret Manager as files mounted on the kubernetes pods.

For this first you need to have an Anthos cluster configured with workload-identity, this blog written by Harsh Manvar gives a detailed explanation on how to create an Anthos cluster with both GKE and EKS using workload-identity(OIDC). If you already have an existing cluster, follow this document for enabling workload-identity on existing cluster.

Once these prerequisites are fulfilled you need to follow these simple steps for using GCP secret manager:

• Install the Secret Store CSI Driver for GCP secret manager in Anthos cluster(It will be applied to both GKE and EKS, else apply the same yaml in both the clusters separately).
• Create a service account for allowing workload-identity to access the secret manager.
• Create a secret and give access to the newly created service account so that workload-identity can fetch it from the secret manager.
• Try to use the secret in your sample deployment.

Follow this documentation for more details on installation and configuration steps.