The Kubernetes Secret resource secures, stores, and controls access to tokens, passwords, certificates, and other secrets in modern computing. The Kubernetes Secrets extension provides your pipeline with access to Kubernetes secrets.

Creating Secrets

Create a secret resource using the Kubernetes yaml configuration language, and persist to your cluster using kubectl. In the below example we store the Docker username and password.

1
2
3
4
5
6
7
8

apiVersion: v1
kind: Secret
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
metadata:
  name: docker

Accessing Secrets

Once our secrets are stored in Kubernetes, we can update our yaml configuration file to request access to our secrets. First we define a secret resource in our yaml for each external secret. We include the path to the secret, and the name or key of value we want to retrieve:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

---
kind: pipeline
name: default

steps:
- name: build
  image: alpine

---
kind: secret
name: username
get:
  path: docker
  name: username

---
kind: secret
name: password
get:
  path: docker
  name: password
...

We can then reference the named secrets in our pipeline:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

kind: pipeline
name: default

steps:
- name: build
  image: alpine
  environment:
    USERNAME:
      from_secret: username
    PASSWORD:
      from_secret: password

---
kind: secret
name: username
get:
  path: docker
  name: username

---
kind: secret
name: password
get:
  path: docker
  name: password

...

Limiting Access

Secrets are available to all repositories and all build events by default. We strongly recommend that you limit access to secrets by repository and build events. This can be done by adding special annotations:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

apiVersion: v1
kind: Secret
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
metadata:
  name: docker
  annotations:
    X-Drone-Repos: octocat/*
    X-Drone-Events: push,tag

Limit By Repository

Use the X-Drone-Repos key to limit which repositories can access your secret. The value is a comma-separate list of glob patterns. If a repository name matches at least one of the patterns, it is granted access to the secret.

Limit access to a single repository:

 7
 8
 9
10

metadata:
  name: docker
  annotations:
    X-Drone-Repos: octocat/hello-world

Limit access to all repositories in an organization:

 7
 8
 9
10

metadata:
  name: docker
  annotations:
    X-Drone-Repos: octocat/*

Limit access to multiple repositories or organizations:

 7
 8
 9
10

metadata:
  name: docker
  annotations:
    X-Drone-Repos: octocat/*,spaceghost/*

Limit By Event

Use the X-Drone-Events key to limit which build events can access your secret. The value is a comma-separate list of events. If a build matches at least one of the events, it is granted access to the secret.

Limit access to push and tag events:

 7
 8
 9
10

metadata:
  name: docker
  annotations:
    X-Drone-Events: push,tag

You can combine annotations to limit by repository and event:

 7
 8
 9
10
11

metadata:
  name: docker
  annotations:
    X-Drone-Repos: octocat/*
    X-Drone-Events: push,tag