From 299b9ae3722dc93b11b047f7da8079fb8eccbac5 Mon Sep 17 00:00:00 2001 From: Cody Landstrom Date: Fri, 28 Feb 2025 23:05:09 -0500 Subject: [PATCH 1/4] add page on integration with GCP Secrets Manager --- sidebars.js | 1 + 1 file changed, 1 insertion(+) diff --git a/sidebars.js b/sidebars.js index 85417d715..2a9549d68 100644 --- a/sidebars.js +++ b/sidebars.js @@ -161,6 +161,7 @@ module.exports = { 'admin/cloud-credentials/gcp-cloud-credentials', ], }, + 'admin/integrations/gcp-secrets-manager', 'admin/integrations/okta-user-deprovisioning', { type: 'category', From 07f04e675509f736dbd897c496b179fdb1ab5484 Mon Sep 17 00:00:00 2001 From: Cody Landstrom Date: Mon, 3 Mar 2025 08:13:34 -0800 Subject: [PATCH 2/4] add the new page --- .../integrations/gcp-secrets-manager.mdx | 84 +++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 src/content/admin/integrations/gcp-secrets-manager.mdx diff --git a/src/content/admin/integrations/gcp-secrets-manager.mdx b/src/content/admin/integrations/gcp-secrets-manager.mdx new file mode 100644 index 000000000..90702af21 --- /dev/null +++ b/src/content/admin/integrations/gcp-secrets-manager.mdx @@ -0,0 +1,84 @@ +--- +title: Using GCP Secrets Manager with Okteto +description: Learn how to securely access secrets stored in Google Cloud Secrets Manager from an Okteto Development Environment +sidebar_label: GCP Secrets Manager +id: gcp-secrets-manager +--- + +# Using GCP Secrets Manager with Okteto + +## Overview +This guide explains how to securely access secrets stored in **Google Cloud Secrets Manager** from an Okteto Development Environment. The recommended authentication method uses **Workload Identity Federation**, allowing developers to authenticate without storing long-lived service account keys. + +For a complete working example, refer to the [Okteto Community GCP Secrets Manager repository](https://github.com/okteto-community/gcp-secret-manager). + +--- + +## Prerequisites +Before proceeding, ensure you have the following: + +- **Google Cloud Project** with **Secrets Manager API enabled** +- **Workload Identity Federation** configured as per [Okteto’s GCP Cloud Credentials Guide](admin/cloud-credentials/gcp.mdx) +- **Okteto CLI** installed and configured +- **kubectl** and **gcloud CLI** installed + +--- + +## Step 1: Configure Workload Identity Federation +To authenticate your Okteto workloads with Google Cloud, follow the steps in the [Okteto GCP Cloud Credentials Guide](admin/cloud-credentials/gcp.mdx). This method ensures secure access to GCP services without using long-lived credentials. + +--- + +## Step 2: Store and Retrieve Secrets in GCP Secrets Manager +### 2.1 Store a Secret +To store a secret file in **Google Cloud Secrets Manager**, follow these steps: + +#### **Create a local secret file** +Here we'll create a secret file `top-secret-information.txt` with the content: +``` +MY_NAME=cindy +MY_COLOR=valencia green +``` +```sh +echo -e "MY_NAME=cindy\nMY_COLOR=valencia green" > top-secret-information.txt +``` + +#### **Create a new secret in GCP** +```sh +gcloud secrets create top-secret-information --replication-policy="automatic" +``` + +#### **Upload the file as a new version of the secret** +```sh +gcloud secrets versions add top-secret-information --data-file=top-secret-information.txt +``` + +### 2.2 Verify this saved by retrieving the Secret Manually +To retrieve the secret manually from your local environment: + +```sh +gcloud secrets versions access latest --secret=top-secret-information +``` + +--- + +## Step 3: Access GCP Secrets from an Okteto Development Environment +### 3.1 Deploy the Example Application +Ensure your development environment is running in Okteto and has access to the necessary **GCP credentials**. + +Clone the example repository and deploy the sample application: + +```sh +git clone https://github.com/okteto-community/gcp-secret-manager.git +cd gcp-secret-manager +okteto up +``` + +This will start a development container with the necessary permissions. + +### 3.2 Retrieve and Use Secrets in the example Go Application +Once the environment is deployed, go to the **Okteto UI** and click on the **endpoint** that Okteto created for you. The logic in `main.go` from the sample repository retrieves values from the secret file we created in **Google Cloud Secrets Manager**. The output will be similar to this: + +``` +Hi, my name is cindy, and my favorite color is valencia green. +``` \ No newline at end of file From a6f1a54d301c79d167fa199835ff215e04f4ada4 Mon Sep 17 00:00:00 2001 From: Cody Landstrom Date: Thu, 11 Jun 2026 17:14:14 -0700 Subject: [PATCH 3/4] docs(tutorials): add Google Cloud Secret Manager tutorial Moves the GCP Secret Manager page from admin/integrations to the tutorials section per review feedback, and aligns the content with the tested okteto-community/gcp-secret-manager example (Admin Variables + service account key), with Workload Identity Federation linked as the keyless alternative. Co-Authored-By: Claude Fable 5 Signed-off-by: Cody Landstrom --- sidebarTutorials.js | 1 + src/tutorials/gcp-secret-manager.mdx | 102 +++++++++++++++++++++++++++ 2 files changed, 103 insertions(+) create mode 100644 src/tutorials/gcp-secret-manager.mdx diff --git a/sidebarTutorials.js b/sidebarTutorials.js index 839f1cfe7..ed7c6a137 100644 --- a/sidebarTutorials.js +++ b/sidebarTutorials.js @@ -28,6 +28,7 @@ module.exports = { 'external-resources', 'webpack', 'using-launchdarkly-and-okteto-to-automate-modern-feature-flag-management', + 'gcp-secret-manager', 'divert', 'optimize-your-development-environment', 'create-and-use-volume-snapshots', diff --git a/src/tutorials/gcp-secret-manager.mdx b/src/tutorials/gcp-secret-manager.mdx new file mode 100644 index 000000000..d122dad70 --- /dev/null +++ b/src/tutorials/gcp-secret-manager.mdx @@ -0,0 +1,102 @@ +--- +title: Using Google Cloud Secret Manager with Okteto +description: Inject secrets stored in Google Cloud Secret Manager into your Okteto Development and Preview Environments +id: gcp-secret-manager +--- + +[Google Cloud Secret Manager](https://cloud.google.com/security/products/secret-manager) stores API keys, passwords, certificates, and other sensitive data in your GCP account. Okteto can retrieve these secrets when deploying your application, so your Development and Preview Environments use the same secret store as the rest of your infrastructure and developers never handle the secret values directly. + +This tutorial deploys the [okteto-community/gcp-secret-manager](https://github.com/okteto-community/gcp-secret-manager) sample application: a Go web server that reads its configuration from an `.env` file created at deploy time from a secret stored in Secret Manager. + +## Prerequisites + +- Admin access to an Okteto instance +- A GCP project with the [Secret Manager API enabled](https://cloud.google.com/secret-manager/docs/configuring-secret-manager) +- The [gcloud CLI](https://cloud.google.com/sdk/docs/install) installed and authenticated against your GCP project +- The [Okteto CLI](/docs/get-started/install-okteto-cli/) installed and configured + +## Giving your Okteto instance access to your GCP account + +Okteto authenticates to GCP with a dedicated service account whose key you store as [Admin Variables](/docs/core/okteto-variables/#admin-variables). Admin Variables are available to the deploy commands of every Development and Preview Environment in your Okteto instance. + +1. [Create a service account](https://cloud.google.com/iam/docs/service-accounts-create) for your Okteto instance. Grant it the minimum set of permissions it needs — for this tutorial, the `Secret Manager Secret Accessor` role is enough. +2. [Create a service account key](https://cloud.google.com/iam/docs/keys-create-delete) and save it locally. +3. In the Okteto Admin Dashboard, navigate to **Admin → Variables** and create the following Admin Variables: + - `GCP_PROJECT_ID`: the ID of the GCP project you are using + - `GCP_SERVICE_KEY`: the base64-encoded value of the service account key you created + +You can generate the base64 value of the key with: + +```bash +base64 -i .json +``` + +:::tip +If you prefer not to manage long-lived service account keys, you can configure keyless authentication with [Workload Identity Federation](/docs/admin/cloud-credentials/gcp-cloud-credentials/) instead. The rest of this tutorial uses the service account key approach. +::: + +## Creating the secret + +The sample application expects a secret named `top-secret-information` containing an `.env` file with two values. Create a local file with the secret content: + +```bash +echo -e "MY_NAME=cindy\nMY_COLOR=valencia green" > top-secret-information.txt +``` + +Create the secret in Secret Manager: + +```bash +gcloud secrets create top-secret-information --replication-policy="automatic" +``` + +Upload the file as the first version of the secret: + +```bash +gcloud secrets versions add top-secret-information --data-file=top-secret-information.txt +``` + +Verify the secret by retrieving it: + +```bash +gcloud secrets versions access latest --secret=top-secret-information +``` + +## Deploying the Development Environment + +Clone the sample repository and deploy it: + +```bash +git clone https://github.com/okteto-community/gcp-secret-manager.git +cd gcp-secret-manager +okteto deploy +``` + +You can also deploy the repository directly from the Okteto UI. + +The deploy section of the `okteto.yaml` in the sample repository authenticates to GCP using the Admin Variables you created, downloads the secret into an `.env` file, and deploys the application with it: + +```yaml +deploy: + # this image already contains the gcloud CLI, so developers don't need to + # install or configure anything except the Okteto CLI + image: google/cloud-sdk:alpine + commands: + - name: Configure GCP credentials + command: | + echo ${GCP_SERVICE_KEY} | base64 -d | gcloud auth activate-service-account --key-file=- + gcloud --quiet config set project ${GCP_PROJECT_ID} + + - name: Create the .env file using the secrets stored in Secret Manager + command: gcloud secrets versions access "latest" --secret=top-secret-information > .env-okteto + + - name: Deploy the application + command: okteto deploy --file docker-compose.yaml +``` + +When the deploy finishes, open the endpoint Okteto created for you from the Okteto UI. The application reads `MY_NAME` and `MY_COLOR` from the `.env` file built from your secret: + +``` +Hi, my name is cindy, and my favorite color is valencia green +``` + +To use a different secret in your own application, change the `--secret` flag in the deploy command to the name of your secret. Secrets are downloaded only during deployment — rotate a secret in Secret Manager and redeploy to pick up the new value. From 6d5d1dc3eec47318e49cfac9409fb69afd027e6f Mon Sep 17 00:00:00 2001 From: Cody Landstrom Date: Thu, 11 Jun 2026 17:16:19 -0700 Subject: [PATCH 4/4] docs(tutorials): move GCP Secret Manager page out of admin integrations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per review feedback, this content is a tutorial rather than an admin integration — listing it under admin suggested it could manage Okteto installation secrets. Co-Authored-By: Claude Fable 5 Signed-off-by: Cody Landstrom --- sidebars.js | 1 - .../integrations/gcp-secrets-manager.mdx | 84 ------------------- 2 files changed, 85 deletions(-) delete mode 100644 src/content/admin/integrations/gcp-secrets-manager.mdx diff --git a/sidebars.js b/sidebars.js index a836f2f74..c979a66d7 100644 --- a/sidebars.js +++ b/sidebars.js @@ -188,7 +188,6 @@ module.exports = { 'admin/cloud-credentials/gcp-cloud-credentials', ], }, - 'admin/integrations/gcp-secrets-manager', 'admin/integrations/okta-user-deprovisioning', { type: 'category', diff --git a/src/content/admin/integrations/gcp-secrets-manager.mdx b/src/content/admin/integrations/gcp-secrets-manager.mdx deleted file mode 100644 index 90702af21..000000000 --- a/src/content/admin/integrations/gcp-secrets-manager.mdx +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Using GCP Secrets Manager with Okteto -description: Learn how to securely access secrets stored in Google Cloud Secrets Manager from an Okteto Development Environment -sidebar_label: GCP Secrets Manager -id: gcp-secrets-manager ---- - -# Using GCP Secrets Manager with Okteto - -## Overview -This guide explains how to securely access secrets stored in **Google Cloud Secrets Manager** from an Okteto Development Environment. The recommended authentication method uses **Workload Identity Federation**, allowing developers to authenticate without storing long-lived service account keys. - -For a complete working example, refer to the [Okteto Community GCP Secrets Manager repository](https://github.com/okteto-community/gcp-secret-manager). - ---- - -## Prerequisites -Before proceeding, ensure you have the following: - -- **Google Cloud Project** with **Secrets Manager API enabled** -- **Workload Identity Federation** configured as per [Okteto’s GCP Cloud Credentials Guide](admin/cloud-credentials/gcp.mdx) -- **Okteto CLI** installed and configured -- **kubectl** and **gcloud CLI** installed - ---- - -## Step 1: Configure Workload Identity Federation -To authenticate your Okteto workloads with Google Cloud, follow the steps in the [Okteto GCP Cloud Credentials Guide](admin/cloud-credentials/gcp.mdx). This method ensures secure access to GCP services without using long-lived credentials. - ---- - -## Step 2: Store and Retrieve Secrets in GCP Secrets Manager -### 2.1 Store a Secret -To store a secret file in **Google Cloud Secrets Manager**, follow these steps: - -#### **Create a local secret file** -Here we'll create a secret file `top-secret-information.txt` with the content: -``` -MY_NAME=cindy -MY_COLOR=valencia green -``` -```sh -echo -e "MY_NAME=cindy\nMY_COLOR=valencia green" > top-secret-information.txt -``` - -#### **Create a new secret in GCP** -```sh -gcloud secrets create top-secret-information --replication-policy="automatic" -``` - -#### **Upload the file as a new version of the secret** -```sh -gcloud secrets versions add top-secret-information --data-file=top-secret-information.txt -``` - -### 2.2 Verify this saved by retrieving the Secret Manually -To retrieve the secret manually from your local environment: - -```sh -gcloud secrets versions access latest --secret=top-secret-information -``` - ---- - -## Step 3: Access GCP Secrets from an Okteto Development Environment -### 3.1 Deploy the Example Application -Ensure your development environment is running in Okteto and has access to the necessary **GCP credentials**. - -Clone the example repository and deploy the sample application: - -```sh -git clone https://github.com/okteto-community/gcp-secret-manager.git -cd gcp-secret-manager -okteto up -``` - -This will start a development container with the necessary permissions. - -### 3.2 Retrieve and Use Secrets in the example Go Application -Once the environment is deployed, go to the **Okteto UI** and click on the **endpoint** that Okteto created for you. The logic in `main.go` from the sample repository retrieves values from the secret file we created in **Google Cloud Secrets Manager**. The output will be similar to this: - -``` -Hi, my name is cindy, and my favorite color is valencia green. -``` \ No newline at end of file