Secrets

​

Overview

1. Image registry (Docker, ECR, and GCP) pull secrets, enabling workloads in a GVC to pull images from private repositories.
2. Enabling Control Plane to manage policies in Azure, using the Azure SDK and Azure Connector secret type.

​

Secret Types

• Amazon Web Services (AWS)
• Azure SDK
• Azure Connector
• Docker
• Dictionary
• ECR
• Google Cloud Platform (GCP)
• Keypair
• Opaque
• NATS Account
• TLS
• Username & Password

​

Amazon Web Services (AWS)

1. Create a cloud account.
2. Create an identity.
3. Defining a cloud access policy for the AWS account as part of the identity.

• Secret Key
• Access Key
• Role ARN (Optional)
• External ID (Optional)

​

Azure SDK

• Used to store Azure SDK credentials.
• When creating a Cloud Account using the Azure SDK, a JSON file is generated containing the credentials. This file is uploaded and automatically stored as an Azure-SDK secret.
• Sample Azure-SDK secret content:
  JSON

  Copy

  Ask AI

  {
    "subscriptionId": "2cd2674e-4f89-4a1f-b420-7a1361b46ef7",
    "tenantId": "292f5674-78b0-488b-9ff8-6d30d77f38d9",
    "clientId": "649746ce-d862-49d5-a5eb-7d5aad90f54e",
    "clientSecret": "CONFIDENTIAL"
  }
  

• If the client secret has been compromised or needs to be updated, the content of the secret can be updated using the console or CLI and will be used by the associated Cloud Accounts.

​

Azure Connector

• Used to store Azure Function App credentials.
• When creating a Cloud Account using the Azure Connector, the deployment URL and code will be saved.
• These values can be updated using the console or the CLI.

​

Docker

{
  "auths": {
    "REPOSITORY_URL": {
      "username": "USERNAME",
      "password": "PASSWORD"
    }
  }
}

​

Control Plane

{
  "auths": {
    "ORG_NAME.registry.cpln.io": {
      "username": "<token>",
      "password": "SERVICE_ACCOUNT_KEY"
    }
  }
}

​

Docker Hub

1. Username & Password Keys Example:
   JSON

   Copy

   Ask AI

   {
     "auths": {
       "https://index.docker.io/v1/": {
         "username": "USERNAME",
         "password": "PASSWORD"
       }
     }
   }
   

2. auth Key
   • When using a password, the value of the auth key is the base64 encoded result of the string USERNAME:PASSWORD.
   Example:
   JSON

   Copy

   Ask AI

   {
     "auths": {
       "https://index.docker.io/v1/": {
         "auth": "BASE_64_ENCODING(USERNAME:PASSWORD)"
       }
     }
   }
   

   • When using a Docker Access Token, the value of the auth key is the base64 encoded result of the string USERNAME:DOCKER_ACCESS_TOKEN.
   Example:
   JSON

   Copy

   Ask AI

   {
     "auths": {
       "https://index.docker.io/v1/": {
         "auth": "BASE_64_ENCODING(USERNAME:DOCKER_ACCESS_TOKEN)"
       }
     }
   }
   

​

Azure Container Registry

• Repository URL
• Service Principal ID
• Password

• The format of the repository URI is: REGISTRY_NAME.azurecr.io and can be obtained from the Azure Container Registry section of the Azure Portal.
• The USERNAME is the ID GUID of the Service Principal (e.g., ed0a30b4-5cd0-44af-864a-cf825b0ceeb6).
• The PASSWORD is generated when creating the Service Principal. By default, the password expires after 1 year.

{
  "auths": {
    "REGISTRY_NAME.azurecr.io": {
      "username": "APP_ID",
      "password": "PASSWORD"
    }
  }
}

​

GitHub Container Registry

{
  "auths": {
    "ghcr.io": {
      "username": "controlplane",
      "password": "PERSONAL_ACCESS_TOKEN"
    }
  }
}

​

Dictionary

• Used to securely store key/value pairs that can be used by a workload’s environment variables.
• Multiple key/value pairs can be added to a single dictionary secret.

​

ECR

• AWS Secret Key
• AWS Access Key
• AWS Role ARN (Optional; This role will be assumed after authentication with the IAM user’s programmatic access)
• ECR Repository URIs (e.g., AWS_ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/REPO_NAME)
• External ID (Optional)

1. Add a new IAM User with programmatic access.
2. Create an Access Token for the new user and take note/download the secret and access key.
3. Create a new IAM Policy for the Elastic Container Registry service with the Read action on the specific repositories.
4. Attach the new IAM Policy to the new IAM User.
5. Optionally, impersonate the IAM user with its credentials and try to pull an image locally as described here.
6. Create the ECR secret using either the UI Console or CLI.

​

Amazon ECR Helper Links

• ECR Dashboard
• Private registry concepts

​

Google Cloud Platform (GCP)

• Similar to a Docker and ECR secret, a GCP secret is used when a workload pulls a container image from a private Google Container Registry.
• This secret type is used when configuring a GVC Pull Secret. Workloads that are connected to that GVC will have access to the secret when pulling the image.
• Using the UI, the secret JSON text can be in a file that is uploaded or pasted into the textbox.
• Below is a sample of a GCP secret. The values can be obtained from your GCP account.

{
  "type": "service_account",
  "project_id": "PROJECT_ID",
  "private_key_id": "PRIVATE_KEY_ID",
  "private_key": "PRIVATE_KEY_CERTIFICATE",
  "client_email": "CLIENT_EMAIL",
  "client_id": "CLIENT_ID",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "X509_CERTIFICATE_URL"
}

​

Keypair

• Used to securely store a keypair that can be used by a workload’s environment variables.
• A keypair secret consists of:
  • Secret key
  • Public key
  • Passphrase (required if the secret key is encrypted)
• Using the UI, the secret and public key text can be in a file that is uploaded or pasted into the textbox.
• The keys will be validated and the secret will only be created or updated if they are valid PEM-encoded certificates.

​

Opaque

1. cpln://secret/SECRET_NAME.payload
   • If the option to perform a base64 decode at runtime is enabled, the decoded value will be returned.
2. cpln://secret/SECRET_NAME (without the .payload)
   • If the option to perform a base64 decode at runtime is enabled, the encoding property will be set to base64. It is the responsibility of the user to perform the base64 decode.
   Example values returned: base64: "{\"payload\":\"VGhpcyBpcyBhbiBvcGFxdWUgaW4gYmFzZTY0\",\"encoding\":\"base64\"}" plain text: "{\"payload\":\"This is an opaque secret in plain text\",\"encoding\":\"plain\"}"

​

NATS Account

• Used to store NATS Account credentials.
• A NATS Account secret consists of:
  • Account ID
  • Private Key
• These properties will be validated and the secret will only be created or updated if they are valid.

​

TLS

• Used to securely store a Transport Layer Security (TLS) secret that can be used by a workload’s environment variables.
• A TLS secret consists of a:
  • Key
  • Certificate
  • Chain Certificate (optional if the certificate is self-signed or not part of the installed root certificates)
• Using the UI, the secret can be in a file that is uploaded or pasted into the textbox.
• The certificates will be validated and the secret will only be created or updated if they are valid PEM-encoded certificates

​

Username & Password

• Used to securely store a username and password secret that can be used by a workload’s environment variables.
• The secret consists of:
  • Username
  • Password
  • Encoding (Base64 / Plain Text)
• The secret will only be created or updated if the username and password are valid strings.

​

Permissions

​

Reveal Permission

​

Use Permission

• GVC’s pull secret
• Container’s environment variables
• Policy’s binding

​

Updating Secrets

​

Access Report

​

CLI