--- title: "How to use Kubernetes External Secret Operator with Secret Manager" description: "Learn how to set up the Kubernetes External Secrets Operator to use the OVHcloud Secret Manager as a provider." url: https://docs.us.ovhcloud.com/en/manage-and-operate/secret-manager/external-secret-operator lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # How to use Kubernetes External Secret Operator with Secret Manager **Learn how to set up the Kubernetes External Secrets Operator to use the OVHcloud Secret Manager as a provider.** **Warning:** **NOTE:** This guide describes how to use the External Secrets Operator with the **HashiCorp Vault** provider to access the OVHcloud Secret Manager through the HashiCorp Vault KV2-compatible API. OVHcloud now provides a **native External Secrets Operator provider**. We recommend using it for new deployments. See the [OVHcloud provider documentation](https://external-secrets.io/latest/provider/ovhcloud/).   ## Requirements - An [OVHcloud customer account](https://docs.us.ovhcloud.com/en/account/account-information/create-account.md) - You must have [ordered an OKMS domain](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/quick-start.md) or [created a first secret](https://docs.us.ovhcloud.com/en/manage-and-operate/secret-manager/use-secret-manager.md) - An [authentication method configured](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/okms-authentication-methods.md) for the OKMS data plane (this guide uses a Personal Access Token) - A [Managed Kubernetes Service](https://us.ovhcloud.com/public-cloud/kubernetes/) cluster   ## Instructions ### Set up the Secret Manager To allow access to the Secret Manager, you will need to have a `token`, the `region`, and the `okms-id` of your Secret Manager. #### Credential creation Create an [IAM local user](https://docs.us.ovhcloud.com/en/account/account-information/manage-local-users.md) with access rights on your domain, or use a [service account](https://docs.us.ovhcloud.com/en/manage-and-operate/api/managing-ovhcloud-service-accounts.md). See [OKMS authentication methods](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/okms-authentication-methods.md) for the full setup and IAM policy templates. The user should be a member of a group with the ADMIN role. If you are using [IAM policies](https://docs.us.ovhcloud.com/en/account/account-information/use-iam-policies-console.md) instead, the user should have at least the following rights on the OKMS domain: - `okms:apikms:secret/create` - `okms:apikms:secret/version/getData` - `okms:apikms:secret/get` - `okms:apiovh:secret/get` Alternatively, it's possible to create a user using the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli): ``` ovhcloud iam user create --login "secretmanager-b1033fdd-xxxx-xxxx-xxxx-xxxxxxxxx" --group ADMIN --description "A user created for Secret Manager, linked to xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx" --password "secretmanager-xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx" --email "secretmanager-xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx@ovhcloud.com" ``` Then create a Personal Access Token (PAT) `user_pat`: ##### Via the API Use the following API call: [POST /me/identity/user/{user}/token](https://api.us.ovhcloud.com/console/?section=/me&branch=v1#post-/me/identity/user/-user-/token) With the following payload (fill it in with your own values): ``` { "description": "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx", "name": "pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx" } ``` The API will answer with: ``` { "creation": "2025-11-13T10:38:44.658926311Z", "description": "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx", "expiresAt": null, "lastUsed": null, "name": "pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx", "token": "eyJhbGciOiJ...punpVAg" } ``` ##### Via the CLI The PAT can be created with the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli) and the following command (fill it in with your own values): ``` ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx" ``` CLI will answer with the `token` value: ``` ✅ Token Secret-Manager created successfully, value: eyJhbGciOiJ...punpVAg ``` As an alternative, you can store the PAT directly in an environment variable: ``` PAT_TOKEN=$(ovhcloud iam user token create {user} --name pat-secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx --description "PAT secret manager for domain secretmanager-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx" -j | jq .details.token | tr -d '"') ; echo $PAT_TOKEN ``` Keep the value of the `token` field as it will never be prompted again and will be used to authenticate to the Secret Manager as `user_pat`.   #### Secret Manager information You will also need the `region` and the `okms-id` of the OKMS domain you want to use. This ID and this region can be found in the [OKMS domain dashboard](https://manager.us.ovhcloud.com/#/okms/key-management-service/) or via the [OVHcloud CLI](https://github.com/ovh/ovhcloud-cli): ``` $ ovhcloud okms list ┌──────────────────────────────────────┬─────────────┐ │ id │ region │ ├──────────────────────────────────────┼─────────────┤ │ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx │ us-east-vin │ │ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx │ us-east-vin │ └──────────────────────────────────────┴─────────────┘ ```   ### Set up the Secret Provider in Kubernetes #### Install the External Secrets Operator (ESO) on your Kubernetes cluster ``` helm repo add external-secrets https://charts.external-secrets.io helm repo update helm install external-secrets \ external-secrets/external-secrets \ -n external-secrets \ --create-namespace \ --set installCRDs=true ``` Check that the ESO is running: ``` $ kubectl get all -n external-secrets NAME READY STATUS RESTARTS AGE pod/external-secrets-8cbc56569-9875p 1/1 Running 0 12s pod/external-secrets-cert-controller-565fcd479b-xbkcp 0/1 Running 0 12s pod/external-secrets-webhook-7fb59d4b88-9tkl6 0/1 Running 0 12s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/external-secrets-webhook ClusterIP 10.3.43.102 443/TCP 13s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/external-secrets 1/1 1 1 13s deployment.apps/external-secrets-cert-controller 0/1 1 0 13s deployment.apps/external-secrets-webhook 0/1 1 0 13s NAME DESIRED CURRENT READY AGE replicaset.apps/external-secrets-8cbc56569 1 1 1 13s replicaset.apps/external-secrets-cert-controller-565fcd479b 1 1 0 13s replicaset.apps/external-secrets-webhook-7fb59d4b88 1 1 0 13s ```   #### Create a secret containing the PAT Create a `secret.yaml` file: ``` apiVersion: v1 kind: Secret metadata: name: ovhcloud-vault-token namespace: external-secrets stringData: token: ``` The `stringData` field accepts the raw token — Kubernetes base64-encodes it when storing the secret. If you prefer to use the `data` field instead, you must base64-encode the token yourself first (`echo -n "" | base64`). Apply it with the `kubectl apply -f secret.yaml` command. Alternatively, if the `user_pat` is stored in the `PAT_TOKEN` environment variable, create the secret directly with kubectl, which also handles the encoding: ``` kubectl create secret generic ovhcloud-vault-token -n external-secrets --from-literal=token=$PAT_TOKEN ``` The secret should have been created: ``` $ kubectl get secret ovhcloud-vault-token -n external-secrets NAME TYPE DATA AGE ovhcloud-vault-token Opaque 1 5m ``` When you inspect the secret with `kubectl get secret ovhcloud-vault-token -n external-secrets -o yaml`, the value appears under `data`, base64-encoded.   #### Configure the External Secrets Operator First, set up a `ClusterSecretStore` that is responsible for the synchronization with the Secret Manager. We configure the SecretStore using HashiCorp Vault with token authentication and with the OKMS endpoint as backend. Add the `user_pat` as a secret to be able to use it in the charts. To define a new `ClusterSecretStore` resource, create a `clustersecretstore.yaml` file with the following content: ``` apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: vault-secret-store spec: provider: vault: server: "https://.okms.ovh.us/api/" # OKMS endpoint, fill with the correct region and your okms_id path: "secret" version: "v2" auth: tokenSecretRef: name: ovhcloud-vault-token # The k8s secret that contain your PAT key: token namespace: external-secrets ``` **Note:** Only [token authentication](https://external-secrets.io/latest/provider/hashicorp-vault/#token-based-authentication) is supported. **Note:** This integration works with a `SecretStore` as well. The region name can be translated from your region location using: [GET /location](https://api.us.ovhcloud.com/console/?section=/location&branch=v2#get-/location) As an example for **Vint Hill, Virginia**, the OKMS endpoint is **us-east-vin.okms.ovh.us**. Deploy the resource in your cluster: ``` kubectl apply -f clustersecretstore.yaml ```   #### Use the External Secrets Operator Once the `ClusterSecretStore` is set up you can define the `ExternalSecret` that comes from the secret manager. Create an `externalsecret.yaml` file with this content: ``` apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: docker-config-secret namespace: external-secrets spec: refreshInterval: 30m secretStoreRef: name: vault-secret-store kind: ClusterSecretStore target: template: type: kubernetes.io/dockerconfigjson data: .dockerconfigjson: "{{ .mysecret | toString }}" name: ovhregistrycred creationPolicy: Owner data: - secretKey: mysecret remoteRef: key: prod/va1/dockerconfigjson ``` Apply the resource in your cluster: ``` kubectl apply -f externalsecret.yaml ``` It will create a Kubernetes Secret object. ``` $ kubectl get secret -n external-secrets NAME TYPE DATA AGE ... ovhregistrycred kubernetes.io/dockerconfigjson 1 15m ... ``` For any additional information on how to manage the External Secrets Operator, refer to the dedicated documentation, using the HashiCorp Vault provider: [https://external-secrets.io/latest/](https://external-secrets.io/latest/).   ## Go further [OKMS authentication methods](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/okms-authentication-methods.md) [Use Secret Manager with REST API](https://docs.us.ovhcloud.com/en/manage-and-operate/secret-manager/rest-api.md) Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services.