[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[[["\u003cp\u003eAvoid managing application secrets within Cloud Deploy pipelines due to security risks; instead, manage and rotate them externally.\u003c/p\u003e\n"],["\u003cp\u003eThis document recommends two external secrets management approaches for GKE or GKE Enterprise: Google Secret Manager and Hashicorp Vault.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Secret Manager is a fully managed Google Cloud service for securely storing sensitive data like API keys and passwords, accessible via client libraries, Workload Identity, or the Secrets Store CSI driver.\u003c/p\u003e\n"],["\u003cp\u003eHashicorp Vault is an open-source tool for secrets management that integrates with Kubernetes via API access, Vault Agent containers, and the Vault CSI Provider, and has full support and integrations with google cloud.\u003c/p\u003e\n"],["\u003cp\u003eKubernetes Secrets, while designed to store sensitive data, are not considered secure by default and are therefore not recommended in this document without encryption.\u003c/p\u003e\n"]]],[],null,["# Manage application secrets\n\nThis page describes some best practices for managing secrets for applications\nyou deploy to Google Kubernetes Engine or GKE Enterprise clusters using\nCloud Deploy.\n\nBecause injecting application secrets into deployment artifacts introduces\nsecurity risks, avoid managing secrets from within Cloud Deploy\npipelines.\n\nSecrets consumed in this way should be generated, managed, and rotated outside\nof the scope of Cloud Deploy.\n\nSecrets, in this context, refer to sensitive data such as database credentials,\nAPI keys, certificates, or passwords.\n\nKubernetes secrets\n------------------\n\nKubernetes Secrets are secure objects that store sensitive data, such as\npasswords, OAuth tokens, and SSH keys in your clusters, separate from Pods.\nSecrets are similar to ConfigMaps, but are intended to hold confidential data.\n\nBecause Kubernetes Secrets are not secure by default, without encryption, the\napproaches described in this document do not use them.\n\nManaging secrets for use with Cloud Deploy\n------------------------------------------\n\nThis section describes how to manage secrets for applications that you deploy\nusing Cloud Deploy.\n\nThe following are two approaches to secrets management with\nGKE or GKE Enterprise:\n\n- [Google Secret Manager](/secret-manager)\n\n- [Hashicorp Vault](https://www.vaultproject.io/)\n\n### Google Secret Manager\n\nSecret Manager is a fully managed, multi-region Google Cloud\nservice that securely stores API keys, passwords, and other sensitive data.\n\nSecrets from Secret Manager can be accessed from the cluster using the\n[client library](/secret-manager/docs/reference/libraries) and\n[Workload Identity](/kubernetes-engine/docs/how-to/workload-identity)\nauthentication, or using the\n[Secrets Store CSI driver](https://github.com/kubernetes-sigs/secrets-store-csi-driver).\n\nTo use Secret Manager for your application:\n\n1. [Create a secret using Secret Manager](/secret-manager/docs/creating-and-accessing-secrets#create).\n\n2. Reference the secret from your application code [using the SDK](/secret-manager/docs/accessing-the-api).\n\nYou can specify additional metadata for the secret using environment variables,\nfor example secret version, or application environment (such as dev, staging,\nprod).\n\nIf the deployment process for a specific feature includes provisioning of\ninfrastructure, then create or update the secret using Secret Manager as part of\nthe provisioning process, before deploying the application.\n\nFor more information on managing Kubernetes secrets with Secret Manager, see\n[Using Secret Manager with other products](/secret-manager/docs/using-other-products).\n\n### Hashicorp Vault\n\n[Hashicorp Vault](https://www.vaultproject.io/) is a popular and widely used\nopen source tool for managing secrets. Google Cloud has extensive\nintegrations and support for Vault, along with other Hashicorp tools such as\nTerraform.\n\nYou can configure Vault within your Kubernetes cluster as follows:\n\n1. Access Vault secrets through the [API](https://vaultproject.io/api) and authenticate\n using [Workload Identity](/kubernetes-engine/docs/how-to/workload-identity).\n\n2. Inject Secrets into your Kubernetes Pods using\n [Vault Agent](https://learn.hashicorp.com/tutorials/vault/agent-kubernetes)\n containers.\n\n3. Use the [Vault CSI Provider](https://vaultproject.io/docs/platform/k8s/csi) to\n consume those secrets.\n\n| **Note:** when you implement Vault, you're responsible for securing and updating the Vault cluster, and for configuring backups and high availability.\n\nWhat's next\n-----------\n\n- Find out more about Secret Manager [best practices](/secret-manager/docs/best-practices).\n\n- Read a [blog post](https://jryancanty.medium.com/hashicorp-vault-and-terraform-on-google-cloud-security-best-practices-3d94de86a3e9) about security best practices using HashiCorp Vault and Terraform on Google Cloud.\n\n- [Read more about secrets management in GKE](/kubernetes-engine/docs/concepts/security-overview).\n\n- [Learn about configuring Vault on Google Cloud](https://www.vaultproject.io/docs/secrets/gcp)."]]
