Project: external-secrets (Provisioning / Security & Compliance)
File: conjur.md

This section describes how to set up the Conjur provider for External Secrets Operator (ESO). For a working example, see the . Before installing the Conjur provider, you need: A running Conjur Server, with: An accessible Conjur endpoint (for example: `https://myapi.example.com`). Your configured Conjur authentication info (such as `hostid`, `apikey`, or JWT service ID). For more information on configuring Conjur, see . Support for your authentication method (`apikey` is supported by default, `jwt` requires additional configuration). Optional*: Conjur server certificate (see ). A Kubernetes cluster with ESO installed. If you set up your Conjur server with a self-signed certificate, we recommend that you populate the `caBundle` field with the Conjur self-signed certificate in the secret-store definition. The certificate CA must be referenced in the secret-store definition using either `caBundle` or `caProvider`: ```yaml {% include 'conjur-ca-bundle.yaml' %} ``` The Conjur provider is configured as an external secret store in ESO. The Conjur provider supports these two methods to authenticate to Conjur: : uses a Conjur `hostid` and `apikey` to authenticate with Conjur : uses a JWT to authenticate with Conjur This method uses a Conjur `hostid` and `apikey` to authenticate with Conjur. It is the simplest method to set up and use because your Conjur instance requires no additional configuration. !!! Tip Save as the file as: `conjur-secret-store.yaml` ```yaml {% include 'conjur-secret-store-apikey.yaml' %} ``` To connect to the Conjur server, the ESO Conjur provider needs to retrieve the `apikey` credentials from K8s secrets. !!! Note For more information about how to create K8s secrets, see . Here is an example of how to create K8s secrets using the `kubectl` command: ```shell kubectl -n external-secrets create secret generic conjur-creds --from-literal=hostid=MYCONJURHOSTID --from-literal=apikey=MYAPIKEY ``` !!! Note `conjur-creds` is the `name` defined in the `userRef` and `apikeyRef` fields of the `conjur-secret-store.yml` file. !!! Important Unless you are using a , credentials must reside in the same namespace as the SecretStore. ```shell kubectl apply -n external-secrets -f conjur-secret-store.yaml ``` This method uses JWT tokens to authenticate with Conjur. You can use the following methods to retrieve a JWT token for authentication: JWT token from a referenced Kubernetes service account JWT token stored in a Kubernetes secret When you use JWT authentication, the following must be specified in the `SecretStore`: `account` - The name of the Conjur account `serviceId` - The ID of the JWT Authenticator `WebService` configured in Conjur that is used to authenticate the JWT token You can retrieve the JWT token from either a referenced service account or a Kubernetes

For example, to retrieve a JWT token from a referenced Kubernetes service account, the following secret store definition can be used: ```yaml {% include 'conjur-secret-store-jwt-service-account-ref.yaml' %} ``` !!! Important This method is only supported in Kubernetes 1.22 and above as it uses the to get the JWT token from the referenced service account. Audiences can be defined in the . Alternatively, here is an example where a secret containing a valid JWT token is referenced: ```yaml {% include 'conjur-secret-store-jwt-secret-ref.yaml' %} ``` The JWT token must identify your Conjur host, be compatible with your configured Conjur JWT authenticator, and meet all the . You can use an external JWT issuer or the Kubernetes API server to create the token. For example, a Kubernetes service account token can be created with this command: ```shell kubectl create token my-service-account --audience='https://conjur.company.com' --duration=3600s ``` Save the secret store file as `conjur-secret-store.yaml`. ```shell kubectl apply -n external-secrets -f conjur-secret-store.yaml ``` After you have configured the Conjur provider secret store, you can fetch secrets from Conjur. Here is an example of how to fetch a single secret from Conjur: ```yaml {% include 'conjur-external-secret.yaml' %} ``` Save the external secret file as `conjur-external-secret.yaml`. The Conjur provider also supports the Find by Name and Find by Tag ESO features. This means that you can use a regular expression or tags to dynamically fetch multiple secrets from Conjur. ```yaml {% include 'conjur-external-secret-find.yaml' %} ``` If you use these features, we strongly recommend that you limit the permissions of the Conjur host to only the secrets that it needs to access. This is more secure and it reduces the load on both the Conjur server and ESO. ```shell kubectl apply -n external-secrets -f conjur-external-secret.yaml ``` Log in to your Conjur server and verify that your secret exists Review the value of your Kubernetes secret to verify that it contains the same value as the Conjur server ```shell kubectl get secret -n external-secrets conjur -o jsonpath="{.data.secret00}" | base64 --decode && echo ``` Copyright (c) 2023-2024 CyberArk Software Ltd. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at <http://www.apache.org/licenses/LICENSE-2.0> Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.