Using Doppler for Managing Kubernetes TLS/SSL Certificates Secrets in PEM Format

Using Doppler for Managing Kubernetes TLS/SSL Certificates Secrets in PEM Format

Learn how simple managing TLS Certificates in PEM format for Kubernetes hosted applications can be when combined with the Doppler CLI.

Ryan Blunden's photo
Ryan Blunden

Published on Sep 13, 2021

2 min read

Subscribe to our newsletter and never miss any upcoming articles

This tutorial will show you how to sync TLS secrets in PEM format from Doppler to Kubernetes using the Doppler CLI and kubectl.


  • Doppler CLI installed and authenticated
  • Access to a Kubernetes cluster

To follow along with this tutorial, click on the Import to Doppler button below to create the Doppler project containing the required variables, including the TLS certificate and key.

Import to Doppler

Creating the TLS Certificate and Key Secrets in Doppler

You can either use the Doppler dashboard to copy and paste in the contents of your certificate and key, or the Doppler CLI as per below:

doppler secrets set TLS_CERT="$(cat ./tls.cert)"
doppler secrets set TLS_KEY="$(cat ./tls.key)"

Doppler Sync to a Kubernetes TLS Secret

Now that your TLS certificate and key are in Doppler, the next step is syncing them to a Kubernetes secret using the Doppler CLI.

We recommend using Kubernetes' built-in TLS Secret type type as it standardizes the property names inside the secret to tls.crt and tls.key:

kubectl create secret tls doppler-tls-pem \
  --cert <(doppler secrets get TLS_CERT --plain) \
  --key <(doppler secrets get TLS_KEY --plain)

We can see this by describing the secret:

-> kubectl describe secret doppler-tls-pem

Name:         doppler-tls-pem
Namespace:    default


tls.crt:  1545 bytes
tls.key:  1704 bytes

Mount TLS Certificate and Key inside a Kubernetes Deployment

The below deployment mounts the TLS certificate and key inside a container.

As the mountPath is set to /usr/src/app/secrets, the path to the certifica te and key will be:

  • /usr/src/app/secrets/tls.crt
  • /usr/src/app/secrets/tls.key

Enable Automatic Secrets Sync with our Kubernetes Operator

While the Doppler CLI makes it easy to sync TLS secrets, it's only drawback is having to manually sync updates to the TLS secrets in Kubernetes when they're updated in Doppler.

We recommend leveling up to use our Kubernetes Operator which instantly syncs secrets to Kubernetes when changed and includes support for auto-reloading of deployments when secrets are updated inside the cluster.

Learn more by checking out the Kubernetes Operator repository on GitHub.


Awesome work! Now you know how to use Doppler to simplify and securely manage TLS secrets in PEM format for your Kubernetes hosted applications.

Be sure to check out our Kubernetes documentation and reach out in our Doppler Community Forum if you need help.

Proudly part of