<p>I am setting up my <code>Kubernetes</code> cluster using <code>kubectl -k</code> (kustomize). Like any other such arrangement, I depend on some secrets during deployment. The route I want go is to use the <code>secretGenerator</code> feature of <code>kustomize</code> to fetch my secrets from files or environment variables.</p>

<p>However managing said files or environment variables in a secure and portable manner has shown itself to be a challenge. Especially since I have 3 separate namespaces for test, stage and production, each requiring a different set of secrets.</p>

<p>So I thought surely there must be a way for me to manage the secrets in my cloud provider's official way (google cloud platform - secret manager).</p>

<p>So how would the <code>secretGenerator</code> that accesses secrets stored in the secret manager look like?</p>

<p>My naive guess would be something like this:</p>

<pre><code>secretGenerator:
 - name: juicy-environment-config
   google-secret-resource-id: projects/133713371337/secrets/juicy-test-secret/versions/1
   type: some-google-specific-type
</code></pre>

<ul>
<li>Is this at all possible?</li>
<li>What would the example look like?</li>
<li>Where is this documented?</li>
<li><strong>If this is not possible, what are my alternatives?</strong></li>
</ul>

<p>I'm not aware of a plugin for that. The plugin system in Kustomize is somewhat new (added about 6 months ago) so there aren't a ton in the wild so far, and Secrets Manager is only a few weeks old. You can find docs at <a href="https://github.com/kubernetes-sigs/kustomize/tree/master/docs/plugins" rel="nofollow noreferrer">https://github.com/kubernetes-sigs/kustomize/tree/master/docs/plugins</a> for writing one though. That links to a few Go plugins for secrets management so you can probably take one of those and rework it to the GCP API.</p>
