Using Doppler for Managing Kubernetes TLS/SSL Certificates Secrets in PEM Format
Learn how simple managing TLS Certificates in PEM format for Kubernetes hosted applications can be when combined with the Doppler CLI.
This tutorial will show you how to sync TLS secrets in PEM format from Doppler to Kubernetes using the Doppler CLI and kubectl.
- Doppler CLI installed and authenticated
- Access to a Kubernetes cluster
To follow along with this tutorial, click on the Import to Doppler button below to create the Doppler project containing the required variables, including the TLS certificate and key.
Creating the TLS Certificate and Key Secrets in Doppler
You can either use the Doppler dashboard to copy and paste in the contents of your certificate and key, or the Doppler CLI as per below:
doppler secrets set TLS_CERT="$(cat ./tls.cert)" doppler secrets set TLS_KEY="$(cat ./tls.key)"
Doppler Sync to a Kubernetes TLS Secret
Now that your TLS certificate and key are in Doppler, the next step is syncing them to a Kubernetes secret using the Doppler CLI.
We recommend using Kubernetes' built-in TLS Secret type type as it standardizes the property names inside the secret to tls.crt and tls.key:
kubectl create secret tls doppler-tls-pem \ --cert <(doppler secrets get TLS_CERT --plain) \ --key <(doppler secrets get TLS_KEY --plain)
We can see this by describing the secret:
-> kubectl describe secret doppler-tls-pem Name: doppler-tls-pem Namespace: default Labels: Annotations: Type: kubernetes.io/tls Data ==== tls.crt: 1545 bytes tls.key: 1704 bytes
Mount TLS Certificate and Key inside a Kubernetes Deployment
The below deployment mounts the TLS certificate and key inside a container.
As the mountPath is set to /usr/src/app/secrets, the path to the certifica te and key will be:
Enable Automatic Secrets Sync with our Kubernetes Operator
While the Doppler CLI makes it easy to sync TLS secrets, it's only drawback is having to manually sync updates to the TLS secrets in Kubernetes when they're updated in Doppler.
We recommend leveling up to use our Kubernetes Operator which instantly syncs secrets to Kubernetes when changed and includes support for auto-reloading of deployments when secrets are updated inside the cluster.
Learn more by checking out the Kubernetes Operator repository on GitHub.
Awesome work! Now you know how to use Doppler to simplify and securely manage TLS secrets in PEM format for your Kubernetes hosted applications.