Skip to main content
Version: 0.2

Application Secrets

Konstruct uses External Secrets Operator (ESO) to help your applications access cloud secrets securely.

How It Works​

When you create a workload cluster in Konstruct, it automatically sets up permissions to read secrets from your cloud provider. The cluster can access:

  • AWS Secrets Manager: secrets under {cluster-name}/*
  • AWS Systems Manager Parameter Store: parameters under /{cluster-name}/*

Creating Secrets​

  1. Go to your cloud provider's console (AWS Secrets Manager or Systems Manager)
  2. Create secrets using the naming convention: {cluster-name}/your-secret-path
  3. Your applications can now reference these secrets through External Secrets

Example​

For a cluster named staging-cluster:

  1. Create a secret in AWS Secrets Manager named staging-cluster/database-password
  2. In your application, create an External Secret that references this secret
  3. ESO will automatically sync the secret to your Kubernetes cluster

Security​

Each cluster only has permission to read secrets that match its name prefix. This ensures workload isolation - clusters cannot access secrets from other clusters. To further refine this posture for your organization, you can adjust your ESO service account IAM permissions at https://github.com/{gh-org}/{konstruct-org-name}-gitops/blob/main/terraform/aws/modules/workload-cluster/main.tf

What's Next?​

  • Learn more about External Secrets Operator
  • Register your first application with Konstruct and add an external secret to your automatically created helm chart